This computer algorithm might be able to predict the next ISIS attack

Before opening fire on a crowded Orlando nightclub on Sunday, Omar Mateen had been investigated twice by the FBI. He had also posted Islamic State-related threats on Facebook and allegedly used the social media platform to search for information on the San Bernardino terrorists last month, according to a Senate Committee. But Mateen’s web activity didn’t trigger an alarm. Lone wolves are hard to stop, as President Obama pointed out two days after the attack

And in fact, new research in Science Magazine shows lone actors shouldn’t be the top priority when it comes to tracking ISIS online – groups should. In the study, computer scientists charted the ecology of pro-ISIS activity in 2015 on Europe’s biggest social media platform, VKontakte. Like a modern Darwin on an electronic Galapagos, they examined an ecosystem rife with evolving groups of pro-ISIS supporters.

The team found the pace at which these groups appear can theoretically predict a real-life strike — even without reading the specific messages sent by individual group members.

“In our case, almost a week before, we were able to make a pretty reliable prediction when an event was imminent,” said Stefan Wuchty, a computer scientist at the University of Miami and the project’s leader. “If you just look at chatter — or what people are posting — you would not be able to make a prediction with [this] many days’ leeway.”

Mushroom radicalization

Wuchty said this project was birthed a couple years ago by social unrest in Latin America, namely Brazil and Venezuela. The team wondered if a machine-learning algorithm could predict when future protests might surface. They started by tracking real-world movements in the street, but no coherent patterns surfaced. Eventually, they looked into social media, given the platform’s influence on the Arab Uprising in 2011.

The researchers searched for public groups on VKontakte that expressed pro-ISIS sentiments in the form of hashtags or specific language. Over the course of January 1 to August 31, 2015, the team isolated 196 pro-ISIS groups — or aggregates — with just over 108,000 individual followers. (Unlike Facebook, VKontakte users aren’t required to use their real names, but they need a valid phone number to activate an account.) They picked the Russia-based VKontakte because, over the last two years, Facebook and Twitter have pushed to immediately suppress ISIS propaganda.

These pro-ISIS clans behaved like mushrooms in order to survive. Groups would occasionally get shut down by online moderators or hackers. The followers responded with reincarnation, sprouting in a new group, or they moved into another preexisting pack.

Setting this coalescence to math revealed an Achilles heel for pro-ISIS activity online: strike small groups rather than large ones. The team’s algorithm found eliminating small- and medium-sized groups had a disabling effect on the distribution of radicalizing propaganda.

“The paper has some very valuable insight in trying to break up these networks,” said J.M. Berger, a fellow at the International Center for Counterterrorism who specializes in ISIS activity on social media. He wasn’t involved with the study, but said private and government analysts have found breaking up these aggregates inhibits the performance of terrorist networks.

“It’s virtually impossible to completely eradicate these guys from social networks,” Berger said. “But it is possible to inhibit the performance of a network. Propaganda doesn’t circulate, and it’s harder for them to recruit.”

But when shutdown rates drop below a critical threshold, a scenario emerges where “any piece of pro-ISIS material can spread globally” like a contagion, according to the study.

“What you’re seeing is that groups like Daesh, ISIS, have weaponized the internet for purposes of recruiting, propaganda, calls to action,” said former U.S. ambassador Mark Wallace, who is now CEO of the Counter Extremism Project. “[This research and ours shows] you could undermine the reach of Daesh by focusing on much smaller group sets rather than the ubiquitous nature of online discussion by Daesh.”

Violent sprouts

But Wuchty’s team also discovered the rapid appearance or reincarnation of these groups can signal a real-world event. They found, in a second set of VKontakte data, that these groups swarmed right before the ISIS attacks on Kobane, Syria on September 18, 2014.

“What we saw is that right before the onset, the time interval between two aggregates showing up got smaller and smaller and smaller,” Wuchty said. Plus, the surge resembled what happened with Facebook groups prior to mass protests in South America.

“It’s super interesting that they’re able to show this,” said mathematician and conflict economist Michael Spagat of the University of London, who wasn’t involved in the research. “The actual violent event comes at the culmination of this buildup.”

Berger said this result should be taken with caution. As of now, “nobody has managed to crack the mountain of predicting terrorist events,” he said. Aggregates are important in his opinion, but it’s important to remember information also travels from person-to-person. Major events like the Paris attacks don’t tend to leak indicators in social media groups, he said.

“If you’re looking for people of interest to arrest or surveil, then the aggregates are better than randomly scouring the internet,” Berger said. “But not necessarily better than going through a follower-to-follower approach.”

Also, the team only analyzed one ISIS-related attack, due to limited funding for the project. Berger, Spagat and Wuchty believe public funding for this brand of mathematical network analysis has lagged, despite its ability to spot fresh trends. Just last week, Spagat’s team reported that women play crucial roles in online terrorist networks, irrespective of the Islamic State’s record of misogyny.

Regardless, Ambassador Wallace said the top priority should be eliminating ISIS propaganda from the internet, a viewpoint echoed by President Obama two days ago. Wallace highlighted the YouTube videos of Anwar al-Awlaki, a radicalized American citizen who was killed by a U.S. authorized drone strike in 2011.

“You can still go onto YouTube and find 60,000 of his videos,” Wallace said. It’s not easy to find the content, he said, but private and public researchers are developing computer programs that scan online documents, video, images and audio to identify terrorism materials.

“Governmental actors and NGOs have been slow to respond to that, but the first thing to do is be able to remove content and deny the battlefield to the propagandists and recruiters,” Wallace said.