ISIS Groups Gather Online Before Real World Attack, Computer Scientists Find

ISIS supporters lack any real online leadership but find each other quickly and efficiently, according to a new study of 196 pro-ISIS groups.

As ISIS secretly gathered for an unexpected assault on the Syrian city of Kobani in 2014, small groups of its online supporters suddenly combined in a predictable spike of activity, a research team reported on Thursday.

The finding may offer a way to predict future attacks or deter the spread of the militant group’s propaganda. Stopping the spread of ISIS online has taken on renewed urgency with President Obama and law enforcement officials remarking on the internet’s role in radicalizing Orlando shooter Omar Mateen, who killed 49 people at a nightclub last Sunday.

ISIS does not appear to have directed the Orlando attack, Obama said. “It is increasingly clear, however, that the killer took in extremist information and propaganda over the internet,” he said. “Their propaganda, their videos, their postings are pervasive and more easily accessible than we want.”

ISIS lacks any real leadership online, suggests the Science magazine study of 196 pro-ISIS groups with a combined 100,000 members. Because of these groups, “lone wolves” can find each other online within about three weeks, the study found.

The analysis focused on ISIS groups that were sharing terror tips and financing advice on the Russian online social network VK (formerly VKontakte) over six months in 2014. The point of the study was not to look in particular at VK, which has 350 million users worldwide, but at how ISIS supporters, in general, congregate to spread messages.

Anti-terrorism efforts should focus on breaking up small groups of only a few dozen members, before they join these larger ones, the researchers said.

“The data suggests that support for ISIS crystallizes in a very collective way that could be forestalled by attacking small groups of supporters,” study lead author Neil Johnson of the University of Miami told BuzzFeed News. “Instead of monitoring millions of people, cutting down these small groups before they grow larger could forestall them sharing bad ideas.”

While the patterns seen in the online groups couldn’t predict lone wolf attacks, they do show that no one is alone on the internet — small groups of ISIS supporters joined other groups within three weeks of their first appearance online. That means policing of social networks must shut down small pro-ISIS groups in that time window, or it would be too late.

“Disruption of these communities affects spread of ideas and information,” political scientist Karl Rethemeyer of the State University of New York at Albany, who was not involved in the new study, told BuzzFeed News by email. “As a predictive enterprise with respect to attacks by existing entities, this has promise.”

Although ISIS only emerged in 2014 (and has made a heavy investment in online activities), Rethemeyer noted, it’s just the latest incarnation of Al Qaeda in Iraq, which itself sprung from an older Jordanian group, Tawhid and Jihad. Given the organization's long history, he doubted a few months of tracking its online supporters' activities would really provide deep insight into the long-lived organization’s plans.

Johnson and colleagues relied on data from the U.S. Office of the Director of National Intelligence’s IARPA research agency. Facebook and Twitter quickly cut down on pro-ISIS pages, but VK didn’t and ISIS widely used it to spread propaganda among Russian speakers during the study period.

Another study by Johnson’s team was published last week by the journal Science Advances, analyzing the role of female ISIS supporters on the VK network. Although men dominated the numbers of ISIS supporters in the analysis, women were about twice as socially connected in these groups. That suggests that removing female ISIS supporters from social networks should be a priority for anti-terrorism efforts.

Of course, removal of ISIS supporters from overseas social networks raises civil liberties questions, Rethemeyer noted. To do so, the U.S. and its allies must be, “willing to tamper with the assumption that the Internet is open and largely free of intervention.”


Skip to footer