spatial coverage of measures of soil loss). Third,an expanded set of ecosystem services could bequantified, including ecosystem contributions tosecuring water and air quality, both of whichhave deteriorated in China in recent decades,andmental health benefits of exposure to nature(24). Fourth, improved measures can be usedthat more directly link ecosystem services tohuman well-being, such as economic measures ofvalue and direct measures of impact on health,livelihoods, happiness, or other aspects of well-being (25, 26). Finally, better understanding ofhuman behavioral responses to changes in policyor market conditions could improve policy ef-fectiveness. Regularly repeating the CEA can pro-vide insight into future national developmentpathways (27).

REFERENCES AND NOTES

1. Q. Ye, M. H. Glantz, Mitig. Adapt. Strategies Glob. Change 10,159–182 (2005).

2. J. Liu, S. Li, Z. Ouyang, C. Tam, X. Chen, Proc. Natl. Acad.Sci. U.S.A. 105, 9477–9482 (2008).

3. P. Zhang et al., Science 288, 2135–2136 (2000).4. J. Liu, Z. Ouyang, W. Yang, W. Xu, S. Li, in Encyclopedia of

Biodiversity, S. A. Levin, Ed. (Academic Press, Waltham,MA, ed. 2, 2013), pp. 372–384.

5. M.-N. Tuanmu et al., Conserv. Biol., 10.1111/cobi.12669(2016).

6. Materials and methods are available as supplementarymaterials on Science Online.

7. R. Sharp et al., InVEST +VERSION+ User’s Guide (The NaturalCapital Project, Stanford University, University of Minnesota,The Nature Conservancy, and World Wildlife Fund, 2015).

8. P. Kareiva, H. Tallis, T. H. Ricketts, G. C. Daily, S. Polasky, Eds.,Natural Capital: Theory and Practice of Mapping EcosystemServices (Oxford Univ Press, New York, 2011).

9. I. J. Bateman et al., Science 341, 45–50 (2013).10. J. J. Lawler et al., Proc. Natl. Acad. Sci. U.S.A. 111, 7492–7497

(2014).11. S. Hatfield-Dodds et al., Nature 527, 49–53 (2015).12. Millennium Ecosystem Assessment, Ecosystems and

Human Well-Being: Synthesis (Island Press, Washington,DC, 2005).

13. UKNEA (UK National Ecosystem Assessment),The UK National Ecosystem Assessment Technical Report[United Nations Environment Programme (UNEP)–WorldConservation Monitoring Centre, Cambridge, 2011].

14. UNEP, Intergovernmental Science-Policy Platform onBiodiversity and Ecosystem Services, Decision IPBES-2/4:Conceptual framework for the Intergovernmental Science-Policy Platform on Biodiversity and Ecosystem Services:Report of the second session of the plenary of theIntergovernmental Science-Policy Platform on Biodiversity andEcosystem Services (UNEP, 2014).

15. WAVES (Wealth Accounting and the Valuation of EcosystemServices), WAVES Annual Report 2015 (World Bank,Washington, DC, 2015).

16. P. R. Ehrlich, P. M. Kareiva, G. C. Daily, Nature 486, 68–73(2012).

17. Ministry of Environmental Protection of China and ChineseAcademy of Sciences, National Ecosystem Service Zoning inChina (Ministry of Environmental Protection and CAS, Beijing,2015).

18. Ministry of Environmental Protection, National EcologicalProtection Redlining (Ministry of Environmental Protection,Beijing, 2015).

19. China Council for International Cooperation on Environmentand Development, Report on Institutional Innovation ofEcological Protection Redlining (CCICED, Beijing, 2014).

20. Ministry of Transport of China, National Road DevelopmentPlanning (2014–2030) (MTC, Beijing, 2013).

21. A. Viña, W. McConnell, H. B. Yang, Z. C. Xu, J. G. Liu, Sci. Adv.2, e1500965 (2016).

22. B. Fu, Science 321, 611 (2008).23. J. G. Liu, P. H. Raven, Crit. Rev. Environ. Sci. Technol. 40,

823–851 (2010).24. G. N. Bratman, J. P. Hamilton, G. C. Daily, Ann. N.Y. Acad. Sci.

1249, 118–136 (2012).

25. S. R. Carpenter et al., Proc. Natl. Acad. Sci. U.S.A. 106,1305–1312 (2009).

26. C. Folke, S. R. Carpenter, B. Walker, M. Scheffer, Ecol. Soc. 15,20 (2010).

27. National Development and Reform Commission of China,Opinions on Accelerating the Construction of EcologicalCivilization (NDRCC, Beijing, 2013).

ACKNOWLEDGMENTS

We thank the Ministry of Environmental Protection (MEP) ofChina and Chinese Academy of Sciences (CAS) for organizingthe Project, and experts in 31 provinces for collecting the fielddata for statistics analysis on this manuscript. This work wassupported by the Ministry of Finance of China through the

MEP/CAS project “Survey and Assessment of National EcosystemChanges Between 2000 and 2010, China” and by theinternational Natural Capital Project. All the data are availableat www.sciencedb.cn/dataSet/handle/73.

SUPPLEMENTARY MATERIALS

www.sciencemag.org/content/352/6292/1455/suppl/DC1Materials and MethodsFigs. S1 to S5Tables S1 to S5References (28–98)

10 January 2016; accepted 18 May 201610.1126/science.aaf2295

HUMAN BEHAVIOR

New online ecology of adversarialaggregates: ISIS and beyondN. F. Johnson,1 M. Zheng,1 Y. Vorobyeva,2 A. Gabriel,1 H. Qi,1 N. Velasquez,2

P. Manrique,1 D. Johnson,3 E. Restrepo,4 C. Song,1 S. Wuchty5,6*

Support for an extremist entity such as Islamic State (ISIS) somehow manages to surviveglobally online despite considerable external pressure and may ultimately inspire acts byindividuals having no history of extremism, membership in a terrorist faction, or direct linksto leadership. Examining longitudinal records of online activity, we uncovered an ecologyevolving on a daily time scale that drives online support, and we provide a mathematicaltheory that describes it. The ecology features self-organized aggregates (ad hoc groupsformed via linkage to a Facebook page or analog) that proliferate preceding the onset ofrecent real-world campaigns and adopt novel adaptive mechanisms to enhance theirsurvival. One of the predictions is that development of large, potentially potent pro-ISISaggregates can be thwarted by targeting smaller ones.

Extremist entities such as ISIS (known asIslamic State) stand to benefit from theglobal reach and speed of the Internet forpropaganda and recruiting purposes inways that were unthinkable for their prede-

cessors (1–10). This increased connectivity notonly may facilitate the formation of real-worldorganized groups that subsequently carry outviolent attacks (e.g., the ISIS-directed attacks inParis in November 2015) but also may inspireself-radicalized actors with no known history ofextremism or links to extremist leadership to op-erate without actually belonging to a group (e.g.,the ISIS-inspired attack in San Bernardino inDecember 2015) (11). Recent research has usedrecords of attacks to help elucidate group struc-ture in past organizations for which the Inter-net was not a key component (3, 6, 12), thenature of attacks by lone-wolf actors (13), andthe relationship between general online buzzand real-world events (14–16). Online buzz created

by individuals that casually mention ISIS or pro-tests is insufficient to identify any long-termbuildup ahead of sudden real-world events (see,for example, fig. S1). This leaves open the ques-tion of how support for an entity like ISIS de-velops online—possibly before any real-worldgroup has been formed or any real-world attackhas been perpetrated—whether by “recruits” orby those simply “inspired.”Our data sets consist of detailed second-by-

second longitudinal records of online support ac-tivity for ISIS from its 2014 development onwardand, for comparison, online civil protestors acrossmultiple countries within the past 3 years, follow-ing the U.S. Open Source Indicator (OSI) project(14–16). The supplementary materials (SM) pro-vide a roadmap for the paper, data descriptions,and downloads. The data show that operationalpro-ISIS and protest narratives develop throughself-organized online aggregates, each of which isan ad hoc group of followers of an online pagecreated through Facebook or its global equivalents,such as ВКонтакте (VKontakte) at http://vk.com/(Fig. 1). These generic web-based interfaces allowsuch aggregates to form in a language-agnosticway and with freely chosen names that help at-tract followerswithout publicizing theirmembers’identities. Because the focus in this paper is onthe ecosystem rather than the behavior of anyindividual aggregate, the names are not being

SCIENCE sciencemag.org 17 JUNE 2016 • VOL 352 ISSUE 6292 1459

1Department of Physics, University of Miami, Coral Gables,FL 33126, USA. 2Department of International Studies,University of Miami, Coral Gables, FL 33126, USA.3Department of Government, Harvard University, Cambridge,MA 02138, USA. 4Department of Geography and RegionalStudies, University of Miami, Coral Gables, FL 33126, USA.5Department of Computer Science, University of Miami,Coral Gables, FL 33126, USA. 6Center for ComputationalScience, University of Miami, Coral Gables, FL 33126, USA.*Corresponding author. Email: wuchtys@cs.miami.edu

RESEARCH | REPORTSon S

eptember 4, 2020

http://science.sciencem

ag.org/D

ownloaded from

released. They are available on request fromthe authors. Pro-ISIS aggregates inhabit an onlineenvironment in which predatory entities such aspolice cybergroups, individual hackers, and web-site moderators seek to shut down pro-ISIS ac-tivity and narratives (17, 18). In contrast to thelargely mundane chatter that may casually men-tion ISIS on Twitter and in aggregates focusedon sport, for example, pro-ISIS aggregates fre-quently discuss operational details such as routesfor financing, technological know-how, and avoid-ing drone strikes. We chose VKontakte for ourpro-ISIS analysis because (i) pro-ISIS aggregatesare shut down essentially immediately on Face-book, but not on VKontakte; (ii) it is the largestEuropean online social networking service, withmore than 350 million users; (iii) it allowsmultiple languages and is used worldwide; (iv)being based in Russia, it has a high concentra-tion of users of Chechen origin focused in theCaucasus region near ISIS’s main area of in-fluence in the Levant; and (v) ISIS used it tospread propaganda among the Russian-speakingpopulation (2).Our methodology for identifying these pro-ISIS

aggregates was as follows.Wemanually identifiedrelevant narratives using hashtags in multiplelanguages—e.g., #isn, #khilafah, #fisyria, #игиш(i.e., ISIS), #дауля (i.e., dawla, meaning “state”),and #халифат (i.e., “Caliphate”)—and traced theseto underlying aggregates. The specific criterion forinclusion in the list was that the group explicitlyexpressed its support for ISIS, publishing ISIS-related news or propaganda and/or calling forjihad in the name of ISIS. This list was fed into

software application programming interfacesthat expanded it by means of automated searchsnowballing (fig. S2). The expanded aggregatelist was then cross-checked to eliminate falseidentifications. New embedded links were man-ually searched to identify more aggregates andhashtags. We then iterated this process untilclosure of the aggregate list (i.e., the search ledback to aggregates that were already in the list).Although this process was labor intensive, wewere able to find closure on a daily basis in realtime. A similar process was followed for the civilprotest data.We uncovered 196 pro-ISIS aggregates involv-

ing108,086 individual followersbetween1Januaryand 31 August 2015. On any given day, the totalnumber of follows in the follower-aggregatenetwork [i.e., the total number of links that ex-isted on that day from followers (blue nodes) intothe various aggregates (red nodes), as shown inthe inset to Fig. 1) ranged up to 134,857. The dataprovided us with bipartite graphs in which indi-vidual members belong to aggregates but aggre-gates are not linked to each other except throughpeople. This two-mode network has a highly com-plex temporal evolution—with strong heterogene-ity in both the number of follows per individualfollower (i.e., the number of links emanating froma given blue node) and the number of follows peraggregate (i.e., the number of links entering agiven rednode,whichwedefine as the aggregate’ssize)—and no obvious hierarchical structure. Thissuggests that the follower-aggregate dynamics aredriven by self-organization. Such online support islikely a necessary but not sufficient condition for

any real-world actions to take place subsequently,because many additional factors can hinder real-world execution. However, Fig. 2 suggests that theonline proliferation of pro-ISIS or protest aggre-gates can indeed act as an indicator of conditionsbecoming right for the onset of a real-world attackcampaign ormass protests, respectively.We fit thetrend in the creation dates of new online aggre-gates (Fig. 2, A and B) to a well-known organiza-tional development curve (19). The escalationparameter b diverges at these real-world onsets(Fig. 2, C and D) and follows the same mathe-matical dependence (Tc – t)–1 as a wide class ofphysical phase transitions (20), with the diver-gence date Tc matching the actual onset almostexactly (SM). The connection to physical phasetransitions again suggests that self-organizationis a driving factor (20). Although such a diver-gence will not necessarily preempt attacks in-volving only a few individuals, such as in SanBernardino or Paris, it can help indicate an align-ment of favorable conditions and has the advan-tage that it does not rely on any real-world eventshaving yet occurred or likely dates having beencirculated through socialmedia in advance (14–16).The far longer lifetimes for online aggregates ofprotestors in Fig. 2B, as compared with pro-ISISaggregates in Fig. 2A, makes sense because pred-atory online shutdown pressure was far less forthe civil protestors; in particular, we found noevidence of any shutdowns in Fig. 2B, in starkcontrast to Fig. 2A. Figure 2D is likely smootherthan Fig. 2C for the same reason. More aggres-sive antigovernment protests, such as the suddenoutburst in Venezuela in February 2014 (fig. S6),

1460 17 JUNE 2016 • VOL 352 ISSUE 6292 sciencemag.org SCIENCE

10

October November JanuaryDecember

2014 2015September

aggregate individual follower

9

8

7

6

5

4

3

2

1

Fig. 1. Pro-ISIS aggregates.Horizontal bars illustrate timelines of some typical pro-ISIS aggregates. Their names are available from the authors. Each timelinestarts when the aggregate appears and ends when it disappears. (Inset) Snapshot of part of an aggregate-follower network on 1 January 2015 showingindividual followers (blue nodes) linking to pro-ISIS aggregates (red nodes). Followers can link into as many aggregates as they wish. Aggregates emerge of allsizes, where an aggregate’s size is the number of follows linking into it.

RESEARCH | REPORTSon S

eptember 4, 2020

http://science.sciencem

ag.org/D

ownloaded from

generate an intermediate case between Fig. 2, Aand B.We now develop a systems-level theory of

this online aggregate ecology. The aggregate sizevariations observed empirically were charac-terized by distinctive shark-fin shapes (Fig. 3A),with each shutdown of a pro-ISIS aggregatesevering the links into that particular aggregate—hence the abrupt drop. This fragmentationcoexists with self-organized coalescence by whichindividual followers sporadically link into exist-ing aggregates while existing aggregates sporad-ically link into eachother.Although eachaggregate’sprecise shark-fin shapewill depend on its contentand noticeability to external predators, Fig. 3shows that the system-level features are capturedusingonly thisminimal coalescence-fragmentationprocess. At each time step, a phenomenologicalprobability vcoal describes the sporadic additionof 1,2,3,… etc. follows to an aggregate (coalescenceof followers), whereas vfrag describes the sporadicsudden shutdown of an aggregate (fragmentationof followers). Such stochastic shutdown is realisticbecause the predators (e.g., government moni-tors or individual hackers) are largely indepen-dent entities and can only shut down aggregatesthat they happen to find. Larger aggregates shouldbemore noticeable; hence, we can take the prob-

ability of a particular aggregate being picked forcoalescence or targeted for shutdown as propor-tional to the aggregate’s size (21), although this isgeneralizable to other algebraic forms withoutaffecting our main findings (SM). The total num-ber of potential follows N in the system is a sum,over all potential followers, of the maximum num-ber of aggregates that each follower is preparedto follow. The number of follows per individualcan be heterogeneous, and at any time step, notall N follows are necessarily used. Computersimulations of this coalescence-fragmentationprocess reproduce the ecology of shark-fin shapesof all sizes (Fig. 3B) with a power-law distributions–a for the time-average number of aggregatesof size s where a = 2.5. This is similar to the em-pirical value of a = 2.33 that had high goodness-of-fit (P=0.86) (Fig. 3C). These shark-fin dynamicsare robust in that they emerge irrespective ofwhenwe examine themodel’s evolution (Fig. 3B)and for any value of N as a result of the model’sself-similarity—i.e., the coalescence-fragmentationprocess generates the same dynamics across allaggregate sizes (22). Connecting to real-world ISISactivity, we note that the severity of ISIS attacks isalso approximately power-law distributed with ex-ponent a = 2.44 and goodness-of-fit P > 0.1. Themodel can be representedmathematically by the

following coupled, nonlinear differential equationsdescribing the number ns of pro-ISIS aggregatesof size s (s > 1) over time.

@nsðtÞ@t

¼ vcoalN2

X

k¼1

s−1

kðs − kÞnkðtÞns−kðtÞ−

2vcoalsnsðtÞN2

X∞

k¼1

knkðtÞ− vfragsnsðtÞN

ð1ÞAdetailed discussion of Eq. 1 is given in the SM.

Like the data and computer simulation, solvingEq. 1 mathematically yields a power-law s–a forthe time-averaged aggregate size, with an exactexponent a = 2.5 [see (23, 24) and SM for themathematical proof]. The spatial independenceof Eq. 1 is consistent with online interactions beinglargely independent of followers’ separation acrossthe globe. The first term on the right describes theformation of an aggregate of size s (i.e., s follows)from a smaller one through the addition of 1,2,3,...etc. new follows; the second describes the loss ofan aggregate that coalesced with another ag-gregate; and the third describes the fragmenta-tion of an aggregate of size s. ns=1(t) is the pool ofisolated (i.e., unused) follows at time t—i.e.,potential “recruits”, withS∞

s¼1snsðtÞ ¼ N .We take

SCIENCE sciencemag.org 17 JUNE 2016 • VOL 352 ISSUE 6292 1461

Kobane: onset of ISIS attacksSept. 18, 2014

Brazil:onset of mass protestsJune 11, 2013

0.4

0.8

1.2

0.2

0.6

1.0

1.4

September OctoberAugust 2014

Esc

alat

ion

par

amet

er

0.4

0.8

1.2

0.2

0.6

1.0

1.4

2013March April May June JulyFebruary

Time

June 11, 2013

Sept. 18, 2014

Apr Jun Feb Apr Aug DecJun OctAug Oct Dec Feb Apr Oct DecAugJun2012 20142013

Jan Mar Sep NovMay JulJan Mar Sep NovMay JulJan Mar Sep NovMay Jul201320122011

Time

Bra

zil p

rote

st a

gg

reg

ates

Pro

-IS

IS a

gg

reg

ates

Fig. 2. Proliferation in online aggregate creation before the onsets ofrecent real-world campaigns (red vertical lines). (A and C) concern theunexpected assault by ISIS on Kobane in September 2014. (B and D) concernthe unexpected outburst of protests in Brazil in June 2013, commonly termedthe “Brazil Winter,” which involved some violence and for which we were ableto collect accurate information following the Intelligence Advanced ResearchProjects Activity (IARPA) OSI program (14, 15). Horizontal bars in (A) and (B)show timelines for (A) pro-ISIS aggregates on VKontakte and (B) protestor

aggregates on Facebook in Brazil. Each horizontal bar represents oneaggregate. The aggregates are stacked separately along the vertical axis.[(C) and (D)] Divergence of escalation parameter b for aggregate creation(dark blue solid line) coincides with real-world onset at time Tc (vertical redline). The light blue dashed line shows theoretical form (Tc – t)–1. Thesubsequent decrease in both curves likely occurs for system-specific reasonsassociated with coalition bombings starting in (C) and loss of public interestin (D).

RESEARCH | REPORTSon S

eptember 4, 2020

http://science.sciencem

ag.org/D

ownloaded from

N to be reasonably slowly varying, although thiscan be generalized (SM). Adding heterogeneity tothe aggregate formation process (e.g., preferencefor similar or diverse follows) leaves the expo-nent a = 2.5 unchanged, as do a variety of othergeneralizations (table S2) (23, 24).Our theoreticalmodel generates variousmath-

ematically rigorous yet operationally relevantpredictions. First, anti-ISIS agencies can thwartdevelopment of large aggregates that are poten-tially far more potent (21) by breaking up smallerones. As shown in Fig. 3D, adding a simple costinto the model for shutting down an aggregatemakes this strategy actually more effective thantargeting the largest aggregates (SM). Second, ifanti-ISIS agencies are insufficiently active incountermeasures and hence the overall rate atwhich they fragment pro-ISIS clusters becomestoo small—specifically, if the aggregate fragmenta-tion ratevfrag < (NlnN)–1—then pro-ISIS supportwillgrow exponentially fast into one super-aggregate(fig. S11). Third, when fragmentation rates dropbelow a critical value vcriticalfrag , the system enters aregime in which any piece of pro-ISISmaterial canspread globally across the pro-ISIS support net-work through contagion: vcriticalfrag ¼ vcoalp=q, withp and q representing the probabilities of follower-to-follower transmission and follower recovery,respectively (25). To prevent diffusion of poten-tially dangerousmaterial and ideas, the fragmen-

tation rate should be greater than vcoalp/q. Fourth,any online “lonewolf” actor will only truly be alonefor short periods of time (on the order of weeksin Fig. 3A, for example) before being attractedinto one aggregate or another through coalescence.Fifth, a systems-level tool emerges for detectingthe future online emergence of new ISIS-like en-tities, which is to employ our methodology todetermine whether a crude power-law distribu-tion with a near 2.5 begins to emerge for aggre-gate support surrounding a particular theme.At a more microscopic level, the data reveal

that pro-ISIS aggregates exhibit the ability tocollectively adapt in a way that can extend theirlifetime and increase their maximal size (Fig. 4),despite the fact that each aggregate is an ad hocgroup of followers who likely have never met, donot know each other, and do not live in the samecity or country. For the civil protests, by contrast,we detected no such adaptations and no onlinepredatory shutdowns, adding support to the no-tion that the pro-ISIS adaptations are a responseto their high-pressured online environment. Figure4, A to C, illustrates the remarkable speed, variety,and novelty of these adaptations, with 15% ofaggregates exhibiting name changes; 7% exhibit-ing flips between online visibility (i.e., contentopen to any VKontakte user) and invisibility (i.e.,content open only to current followers of the ag-gregate); and 4%exhibiting reincarnation inwhich

an aggregate disappears completely and then re-emerges at a later time with another identity butwithmost (e.g., >60%) of the same followers. Suchreincarnation is not known to occur in real-worldecologies of living organisms. Figure 4D confirmsthat these adaptations tend to increase not onlythe maximum number of followers attracted intothe aggregate (maximumsize) but also its lifetime.The 0.9 value for the reincarnation lifetime can beunderstood as follows: Reincarnation involves theaggregate temporarily disappearing; therefore, anaggregate that uses reincarnation runs a high riskof losing followers because theydonot knowwhen,andwithwhat identity, the core follower groupwillreemerge. Reincarnation hence tends to be usedby aggregates that are attracting unusually highpredation andwould otherwise have had amuchshorter lifetime. Reincarnation extends this life-time beyond its otherwise much shorter value,but not enough to reach the value of 1 corre-sponding to aggregates that experience less in-tense shutdownpressure andhencedonot employadaptations. These observations open up the pos-sibility to add evolutionary game theoretic fea-tures into our systems-level theory to explain themultiple use of particular adaptations by partic-ular aggregates and their decision of when toadapt. A future generalized theory could provepossible, employing game theoretic ideas from(26), for example.

1462 17 JUNE 2016 • VOL 352 ISSUE 6292 sciencemag.org SCIENCE

s

0.01

0.1

1

10

100

1000

1 10 100

#A

gg

reg

ates

of

size

attack largest

aggregatesattack smaller

aggregates

Aggregate size s (# follows)

0

100

200

300

400

500

8000 8500 9000 9500 10000

Time

Ag

gre

gat

e si

ze

Theory: steady-state

Time

0

100

200

300

0 200 400 600 800 1000

Ag

gre

gat

e si

ze

Theory: initial

0.001

0.01

0.1

1

1 10 100 1000 10000

P(S

> s

)

Aggregate size s (# follows)

0 10 20 30 40 50

Time

0

200

400

600

800

1000

1200

1400

1600

1800

Ag

gre

gat

e si

ze

Empirical

Fig. 3. Size dynamics of pro-ISIS aggregates. (A) Empirical size variation ofpro-ISIS aggregates. Shark-fin shapes of all sizes emerge with shutdowns thatare not strongly correlated. (B) Similar results are predicted by our theoreticalmodel, irrespective of whether we consider the model’s initial (left) or steady-state (right) dynamics. Here, the total number of potential follows is N = 500;however, the model’s self-similar dynamics generate the same picture for anyN with shark-fin shapes of all sizes. An aggregate grows by an individual linkingin (i.e., size increases by 1) or by an existing aggregate linking in (i.e., size

increases by >1), as shown by the color change. In (B), knowledge of thetheory’s microscopic dynamics allows us to denote each coalescence of alarge aggregate by a color change, whereas in the empirical data (A), we maintaina constant color for each aggregate. (C) Complementary distribution function forthe observed aggregate sizes. (D) Effect of intervention strategy involving dis-mantling smaller aggregates (SM). Using a larger N increases the vertical andhorizontal scales without changing the main results (see fig. S10). Reddiamonds: smin = 10 and smax = 50. Blue squares: smin = 200 and smax = 1000.

RESEARCH | REPORTSon S

eptember 4, 2020

http://science.sciencem

ag.org/D

ownloaded from

More generally, our findings suggest that in-stead of having to analyze the online activities ofmanymillions of individual potential actors world-wide (27), interested parties can shift their focusto aggregates, of which there will typically be onlya few hundred. Our approach, combining auto-mated data-mining with subject-matter expertanalysis and generative model-building drawnfrom the physical and mathematical sciences, goesbeyond existing approaches to mining such on-line data (28–30). Although recent reports (31) sug-gest that the amount of explicit pro-ISIS material

online may have declined since summer 2015, it ispossible that there is lower detection due to noveladaptations being employed—as in Fig. 4, but nowlikely more sophisticated.

REFERENCES AND NOTES

1. M. Weiss, H. Hassan, ISIS: Inside the Army of Terror (ReganArts, New York, 2015).

2. BBC News, “Russian students targeted as recruitsby Islamic State”; http://linkis.com/dmFgu (24 July 2015).

3. P. Gill, J. Lee, K. Rethemeyer, J. Horgan, V. Asal, Int. Interact.:Empir. Theor. Res. Int. Relat. 40, 52–78 (2014).

4. R. Wrangham, L. Glowacki, Hum. Nat. 23, 5–29 (2012).

5. J. E. Smith et al., Trends Ecol. Evol. 31, 54–66 (2016).6. M. Kenney et al., Appl. Ergon. 44, 739–747 (2013).7. J. N. Shapiro, The Terrorist’s Dilemma: Managing Violent Covert

Organizations (Princeton Univ. Press, 2013).8. A. M. Morgenstern et al., Am. J. Phys. 81, 805 (2013).9. G. King, J. Pan, M. E. Roberts, Science 345, 1251722 (2014).10. D. J. Watts, P. S. Dodds, J. Consum. Res. 34, 441–458 (2007).11. F. Karimi, C. E. Shoichet, D. Ford, “San Bernardino shooters

were radicalized 'for quite some time,' FBI says.”CNN News, 7 December 2015; www.cnn.com/2015/12/07/us/san-bernardino-shooting/index.html.

12. V. S. Subrahmanian, A. Mannes, A. Sliva, J. Shakarian,J. P. Dickerson, Computational Analysis of Terrorist Groups:Lashkar-e-Taiba (Springer, New York, 2013).

13. P. Gill, Lone Actor Terrorists: A Behavioural Analysis(Routledge, London, 2015).

14. P. Manrique et al., Context matters: Improving the uses of bigdata for forecasting civil unrest: Emerging phenomena and big data.IEEE Intelligence and Security Informatics (IEEE, 2013), pp. 169–172.

15. J. Matheny, Test and evaluation in ACE and OSI IARPA (2013);available online at http://semanticommunity.info/@api/deki/files/21696/3-ACE_and_OSI_NIST_Brief.pdf.

16. J. Cadena et al., PLOS ONE 10, e0128879 (2015).17. BBC News, “Anonymous targets IS sympathisers on Twitter”;

www.bbc.com/news/technology-33608369 (21 July 2015).18. BBC News, “Islamic State web accounts to be blocked by new

police team”; www.bbc.com/news/world-europe-33220037(22 June 2015).

19. N. Johnson et al., Science 333, 81–84 (2011).20. A.-L. Barabasi, H. E. Stanley, Fractal Concepts in Surface

Growth (Cambridge University Press, 1995).21. V. Asal, S. M. Chermak, S. Fitzgerald, J. D. Freilich,

Crim. Justice Rev. 2016, 10.1177/0734016815626970 (2016).22. N. F. Johnson, P. Jefferies, P. M. Hui, Financial Market

Complexity (Oxford Univ. Press, 2003), chap. 5.23. J. C. Bohorquez, S. Gourley, A. R. Dixon, M. Spagat,

N. F. Johnson, Nature 462, 911–914 (2009).24. B. Ruszczycki, B. Burnett, Z. Zhao, N. F. Johnson, Eur. Phys. J.

72, 289–302 (2009).25. Z. Zhao et al., Phys. Rev. E Stat. Nonlin. Soft Matter Phys. 81,

056107 (2010).26. M. A. Nowak, Evolutionary Dynamics: Exploring the Equations of

Life (Belknap Press, New York, 2006).27. N. Perra et al., Phys. Rev. Lett. 109, 238701 (2012).28. D. Koutra, D. Jin, Y. Ning, C. Faloutsos, Perseus: An

interactive large-scale graph mining and visualization tool(DEMO), VLDB 2015, Kohala Coast, Hawaii, 31 August to4 September 2015.

29. Q. Zhao, M. Erdogdu, H. He, A. Rajaraman, J. Leskovec,SEISMIC: A self-exciting point process model for predictingtweet popularity, ACM SIGKDD International Conference onKnowledge Discovery and Data Mining (KDD), Sydney, 10 to13 August 2015.

30. A. Stanton, A. Thart, A. Jain, P. Vyas, A. Chatterjee,P. Shakarian, arXiv:1508.01192v1 (2015).

31. J. M. Berger, H. Perez, The Islamic State’s diminishing returnson Twitter. GW Program on Extremism (2016); available athttps://cchs.gwu.edu/sites/cchs.gwu.edu/files/downloads/Berger_Occasional%20Paper.pdf.

ACKNOWLEDGMENTS

N.F.J. gratefully acknowledges partial support for preliminarywork from Intelligence Advanced Research Projects Activity(IARPA) under grant D12PC00285 and recent funding underNational Science Foundation (NSF) grant CNS1500250 and AirForce (AFOSR) grant 16RT0367. The views and conclusionscontained herein are solely those of the authors and do notrepresent official policies or endorsements by any of the entitiesnamed in this paper. Data described are presented in anExcel file available in the supplementary materials, and code isprovided in the SM document.

SUPPLEMENTARY MATERIALS

www.sciencemag.org/content/352/6292/1459/suppl/DC1Materials and MethodsSupplementary TextFigs. S1 to S12Tables S1 to S3Database S1References

13 December 2015; accepted 12 May 201610.1126/science.aaf0675

SCIENCE sciencemag.org 17 JUNE 2016 • VOL 352 ISSUE 6292 1463

0 20 40 60 80 100 120 140 160 180 200 220 240

visibleinvisible

0 20 40 60 80 100 120 140 160 180 200 220 240

0 20 40 60 80 100 120 140

Pro

-IS

IS a

gg

reg

ates

Invisibility

Reincarnation

days

Adaptation

AggregateRel.max.size

Rel.life

time

None 1 1

All 1.4 1.4

Name change 1.1 1.5

Invisibility 1.5 2.4

Reincarnation 2.0 (0.9)

Name change

Fig. 4. Evolutionary adaptations. (A to C) Sample of pro-ISIS aggregate timelines showing evolutionaryadaptations (shown by switches in colors) that tend to increase an aggregate’s maximum attained sizeand extend its lifetime (D). Time is measured in days from 1 January 2015. In (A), the switch in colorswithin a given timeline indicates a switch in aggregate name. (B) Dark blue means the aggregate isvisible (i.e., content open to any VKontakte user), while light blue means it is invisible (i.e., content openonly to current followers of the aggregate). (C) Aggregate has a specific initial identity (orange), thendisappears from the Internet for an extended time (white), then reappears with another identity shownby a switch in color. (D) Relative maximum aggregate size and relative lifetime for particular adaptationsand their combinations, given as average values relative to the values for aggregates employing noadaptation. “All” corresponds to aggregates that use name change, invisibility, and reincarnation. See thetext for explanation of the “(0.9)” entry.

RESEARCH | REPORTSon S

eptember 4, 2020

http://science.sciencem

ag.org/D

ownloaded from

New online ecology of adversarial aggregates: ISIS and beyond

S. WuchtyN. F. Johnson, M. Zheng, Y. Vorobyeva, A. Gabriel, H. Qi, N. Velasquez, P. Manrique, D. Johnson, E. Restrepo, C. Song and

DOI: 10.1126/science.aaf0675 (6292), 1459-1463.352Science 

, this issue p. 1459Sciencedevelopment and evolution of such aggregates can be blocked.that would not have been detected by looking at social media references to ISIS alone. The model suggests how theescalation in the number of ISIS-supporting ad hoc web groups (''aggregates'') preceded the onset of violence in a way patterns among online supporters of ISIS and used this information to predict the onset of major violent events. Suddenfollowers between 1 January 1 and 31 August 2015. They developed a statistical model aimed at identifying behavioral

analyzed data collected on ISIS-related websites involving 108,086 individualet al.recruits and funding. Johnson Online support for adversarial groups such as Islamic State (ISIS) can turn local into global threats and attract new

Tackling the advance of online threats

ARTICLE TOOLS http://science.sciencemag.org/content/352/6292/1459

MATERIALSSUPPLEMENTARY http://science.sciencemag.org/content/suppl/2016/06/15/352.6292.1459.DC1

REFERENCES

http://science.sciencemag.org/content/352/6292/1459#BIBLThis article cites 13 articles, 2 of which you can access for free

PERMISSIONS http://www.sciencemag.org/help/reprints-and-permissions

Terms of ServiceUse of this article is subject to the

is a registered trademark of AAAS.ScienceScience, 1200 New York Avenue NW, Washington, DC 20005. The title (print ISSN 0036-8075; online ISSN 1095-9203) is published by the American Association for the Advancement ofScience

Copyright © 2016, American Association for the Advancement of Science

on Septem

ber 4, 2020

http://science.sciencemag.org/

Dow

nloaded from