Patterns in Terrorism and Insurgency: From real events and online extremism to a generative mathematical model.

Full text

Contents
Part I Part Title
1 Patterns in Terrorism and Insurgency: From real events and online
extremism to a generative mathematical model................... 3
Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson
Restrepo
1.1 Introduction.............................................. 4
1.2 Power Law Distributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3 DataandAnalysis......................................... 6
1.4 EmpiricalFindings ........................................ 7
1.5 Discussion for Terrorism and Insurgency . . . . . . . . . . . . . . . . . . . . . . 8
1.6 Applicability to Online Terrorist Support . . . . . . . . . . . . . . . . . . . . . . 9
1.7 Summary ................................................ 11
Appendix...................................................... 12
References..................................................... 14
v

Chapter 1
Patterns in Terrorism and Insurgency:
From real events and online extremism to a
generative mathematical model
Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
Abstract We present a quantitative discussion of patterns that emerge from empiri-
cal data on global terrorist events as well insurgencies, both of which are inextrica-
bly linked to the broad topic of crime. Our interest is in the potential system-level
patterns, which would then suggest some kind of common collective mechanism.
We show that a mesoscopic view of plausible collective behavior by perpetrators,
can then be cast into a set of mathematical equations which have an exact solution.
This solution predicts a system level statistical signature that compares favorably to
the empirical data for global terrorism as well as individual insurgencies. Although
testing the dynamical features of this mathematical model would be hard in the real
world, due to its clandestine nature, we show that an opportunity arises in the online
world. Using this online data, we find good agreement between the predictions of
the model and the collective behavior of online supporters. We discuss the robust-
ness and broader implications of our findings.
Neil F. Johnson
Physics Department, George Washington University, Washington D.C. 20052, U.S.A., e-mail:
neiljohnson@gwu.edu
Stijn van Weezel
School of Economics, University College Dublin, Leinster, Ireland e-mail: weezel.van@gmail.com
Michael Spagat
Department of Economics, Royal Holloway University of London, Egham, Surrey, U.K.e-mail:
M.Spagat@rhul.ac.uk
Dylan Johnson Restrepo
Physics Department, George Washington University, Washington D.C. 20052, U.S.A., e-mail: ddy-
lanj@icloud.com
3

4 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
1.1 Introduction
The ability to determine some deep structure to terrorist campaigns and insurgen-
cies could, in principle, enable more reliable prediction of future patterns of violent
events. This is a momentous task, and one that could seem doomed to failure given
the haphazard, almost random record of violent events that is reported nightly on
the news from across the globe. However, it is the topic that we pursue here and for
which we share some intriguing glimpses of success. As part of this, our focus in
this chapter is on collective phenomena: first, this is because we believe that one-
off attacks by an individual who is acting entirely alone, are less likely to produce
any surprising new patterns at the system level of the entire population. Second, we
believe that if there are interesting patterns, then they are more likely to emerge in
activities that involve a larger collection of people. Just as traffic jam patterns are
known to occur similarly in cities across the world, despite the differences in the
people involved, the mechanical details of their cars, and the environmental factors,
it seems that the sheer fact of having to self-organize in a way that avoids being
found out or apprehended, might lie behind some hidden systematic patterns. In
short, just as two is company and three is a crowd [1, 2, 3]. the crowd behavior of
how humans collectively ‘do’ terrorism and insurgency – and hence in general com-
mit violent acts – might be expected show some form of universality. As we show
here, this indeed seems to be the case.
In the rest of this chapter, we examine the patterns that emerge in terrorism and
insurgencies. We then present a set of mathematical model for this collective behav-
ior. We show that the associated equations have an exact solution which provides
a system level statistical signature. We show that this statistical signature compares
favorably to the empirical data for global terrorism as well as individual insurgen-
cies [4, 7, 5, 6]. We note that there is still much debate in the literature about the
lack of distinction between terrorism and insurgency (and also crime versus domes-
tic terrorism) [8] and so the fact that we find similar patterns for both is reassuring
and aligns with this blurring of definitions. Though testing the dynamical features of
this mathematical model is hard in the real world, due in part to the clandestine na-
ture of such activities and hence human groups, we then discuss how turning to the
online world, provides a new laboratory for such a test. There is surprisingly good
agreement between the behavior of the model over time, and the behavior observed
of online groups of supporters of terrorism. We end by discussing the robustness
and broader implications of our findings.
1.2 Power Law Distributions
Our approach is very much akin to that of astronomy, and indeed much of physics,
in that we start with no theoretical hypothesis and instead simply observe the data,
taking in as much as we can into our analysis as opposed to simply sampling from

1 Patterns in Terrorism and Insurgency 5
it. Then we look for statistical patterns in this large dataset. Much of our analysis
comes from more detailed reports which can be accessed at Refs. [9, 5, 6, 10].
The particular statistical pattern that we will test for, is a so-called power-law dis-
tribution [11] of severity of violent events. This is because a power-law distribution
emerges frequently in the study of collective behavior in systems of interacting ob-
jects (which could include humans) when there are complex feedback mechanisms
at play. We have every reason to believe that in violent events such as terrorism,
there will likely be such feedback processes at work during the preparation and exe-
cution of the attack. The opposite case to this is a process that has no feedback, like
the outcome from tossing a coin. This is well-known to produce a bell curve, which
is another term for a Normal distribution [11]. A power-law distribution therefore
has very different implications to a Normal distribution.
To explain the significance of a power-law, imagine we know the heights of all
the adults in our street, city, or country. If we then make a graph of the distribution
of these heights, we will get an approximate bell curve. Since no-one is 12 feet tall,
and no-one is less than a foot tall, it makes sense that the curve will rise up and
then drop back down again, peaking around a mean height of say 5 feet 7 inches.
This peak occurs at the height which describes the largest number of people and
therefore represents the typical, or average, height of humans. There is a good rea-
son why, like heights, many systems produce a Normal distribution: in each case,
the average value of the quantity being measured is dictated by something intrinsic
to the individuals themselves, and hence something structural and pre-determined,
while the spread (or so-called, fluctuation) in values around this average is usually
due to environmental ad hoc reasons. As far as adult heights go, a person’s body has
an implicit reason based on genes and inheritance to grow to a certain approximate
height. Then if the person has an extreme oversupply or undersupply of nutrition,
they will probably end up somewhere just above or below this value. By contrast,
however, there are many social, economic and biological systems – including the
distribution of the number of events (attacks) in an insurgency or terrorism with s
casualties – which do not follow a peaked distribution, but instead resemble far more
closely the distribution called a power law which has the form p(s)=Msawhere
Mis a constant, sis the size of the event (i.e. severity in our analysis, which is the
number killed in the event), and ais called the power-law exponent [11]. Plotting
such a distribution on log-log paper would, by taking the logarithm of both sides,
produce an approximate straight line with a negative slope of magnitude a[11]. If,
as we find, violent events in terrorism and insurgencies follow a power law, this has
some important consequences as compared to the bell-curve distribution. First, the
most frequent incidents will be ones with fewest fatalities, unlike the case of peo-
ple’s heights. Second, very deadly events with many fatalities will occur – rarely,
but they will occur. This is unlike the case of heights, where the chances are zero
that someone will be taller than 12 feet. For this reason, planning for violent events
is inherently a complex task.

6 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
1.3 Data and Analysis
In our analysis the size sof a discrete event, such as a suicide bombing or an attack,
is defined as the number of people killed in the event, which is termed the severity
of the event. To produce Figs. 1 and 2, we analyzed the new event data on armed
conflict and terrorism. Specifically, our armed-conflict data comes from the Georef-
erenced Event Dataset (GED) of the Uppsala Conflict Data Programme [12] which
is the most accurate and comprehensive georeferenced dataset available [13]. We
also performed a parallel analysis of terrorist incidents, using the Global Terrorism
Database (GTD, the 2017 version), which is provided by the National Consortium
for the Study of Terrorism and Responses to Terrorism (START). The GTD dataset
includes both domestic and trans/inter-national terrorist incidents. The GTD is up-
dated annually and provides the most comprehensive dataset on terrorist events that
is publicly available, covering the period from 1970 to 2016 and including detailed
information on incident times, locations, fatality counts and, when identifiable, the
perpetrating group or individual. We include only events that are, according to the
coding, definitely acts of terrorism causing at least one fatality and that are attributed
to a known organization that has perpetrated at least 30 attacks. Finally, we use only
100101102
100
10-1
10-2
10-3
Size s (i.e. number of casualties) of violent event
ISIS: ! " ≈ "$% for s ≥smin
Power-law exponent ' = 2.5
smin = 15
Goodness-of-fit p = 0.70
Cumulative total number of violent events
Fig. 1.1 Fitted power law for attacks involving ISIS. Event sizes measured as number of people
killed, are plotted on the x-axis against the number of events of that size or larger on the y axis.
Here for convenience we show the cumulative total, but this does not affect the resulting analysis
or the resulting avalue. Red solid line indicates the power law.

1 Patterns in Terrorism and Insurgency 7
events occurring after 1997 because the GTD coding procedures changed in that
year. This leaves us with 16,399 terrorist attacks carried out by 60 groups between
1998 2016.
We use the poweRlaw software package in R [14] to fit the model Msato the
distributions of the event severities above an estimated cut-off value smin using max-
imum likelihood estimation. The smin parameter, the lower threshold, is estimated
using a Kolmogorov-Smirnov approach, where the distance between the cumula-
tive density function of the data and the fitted model is minimized. To account for
parameter uncertainty, the estimates are obtained using a bootstrap procedure with
1,000 iterations.
1.4 Empirical Findings
Figure 1 provides an example of a power law fit to the attacks by ISIS (Islamic State
of Iraq and the Levant). The fit is remarkably good, and has a high goodness of fit.
It yields an empirical value a=2.5. Figure 2 (top) plots the estimated avalues
for the 273 conflicts in our sample against the p-values of bootstrapped tests of the
hypotheses that their data are generated by the fitted power laws for these conflicts;
here the null hypothesis is that the power law distribution cannot be ruled out. Most
conflicts do have size distributions for their violent events that are well fit by power
laws with coefficients clustering around 2.5. At the same time, some conflicts do
display avalues far from 2.5, and some conflicts have very low goodness of fit p-
values. However, low p-values are not necessarily that relevant since no distribution
of violent conflict events will be exactly generated by an exact power law, so we
would normally expect to reject the power-law hypothesis with enough data even
when this distribution is still useful for modeling the event-generating process of a
conflict. Estimated a’s far from 2.5 could stem from data problems, e.g. not having
enough data or having serious flaws in the data-gathering processes for particular
conflicts.
Figure 2 (bottom) provides the same sort of pversus ainformation, but now
for terrorist groups using the GTD data. Note that the nature of these results is
substantially different from earlier work fitting power laws to global terrorist events
[7] because we fit a separate power law to each terrorist organization whereas the
previous work merged together all the events generated by all terrorist organizations.
It shows that power laws with avalues that cluster around 2.5 also tend to fit well
the distributions of violent events generated by terrorist organizations. Thus, there
appear to be close parallels in the behavior of terrorist and insurgent organizations, at
least with respect to the processes that generate their violent events. This empirical
commonality is reassuring given the blurred distinctions between the two types of
organizations [8].

8 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
1.5 Discussion for Terrorism and Insurgency
We have hence found that the size distribution of violent events in modern conflicts
and terrorist campaigns are generally well approximated by power laws with aco-
efficients clustered near 2.5. There are some exceptions, though these exceptions
also tend to have large uncertainties in the values of their coefficients. It will be in-
teresting in the future to look in detail at what might make these few conflicts and
campaigns so different.
One could use the empirical findings concerning the power-law testing and ex-
ponent, as a way of evaluating the appropriateness of models that seek a genera-
tive, minimalistic explanation of human conflict. Among these, is the coalescence-
fragmentation model originally proposed in Ref. [5] in which two populations fight,
and which takes into account the tendency of clusters of insurgents to assemble
for clashes or attacks and then disperse afterwards. It was shown in Ref. [5] that
this two-population model gives very good agreement for the entire distribution of
casualties in various conflicts not just the approximate power-law tail, but also the
low-casualty and high-casualty deviations. If one is interested only in examining the
tail of the distribution, as we do in the present paper, then a simpler version of this
theory is possible in which the dynamical clustering is treated as a stochastic noise
term. This is shown explicitly in the Appendix and Fig. 3. In this case, the effect
of this co-existing coalescence and fragmentation of clusters of fighters produces a
distribution of cluster sizes that has a robust power-law form with a mathematically
derivable exponent of 2.5 (see Fig. 3). Taking the size of a cluster as a measure of
its potential for damage, this suggests that the distribution of casualties should also
be a power-law with exponent around 2.5, exactly as observed for ISIS for example
in Fig. 1. As first explained in 2005 [4], this model corresponds to the picture that
an organization’s total attack strength Nis continually being re-partitioned through
coalescence and fragmentation events. The value of this attack strength Nderives
from the number of its members, its weaponry, its information etc. and hence does
not lead to the conclusion that the size of the organization bounds the severity in any
way (Fig. 3).
The simple, one population version of this model is given in the Appendix where
it is shown how the exponent value of 2.5 emerges directly. It also indicates that
a generalization of this model, where the robustness of larger clusters is allowed
to depend on sin a richer way, produces the variation seen in the empirical data
in Fig. 2 [6]. Though we first presented this simple model explanation in 2005, to
this day we still know of no other model that provides such a plausible microscopic
mechanism, and yet which also predicts a clustering of power-law exponents around
2.5 without specifically cherry-picking model parameter values.

1 Patterns in Terrorism and Insurgency 9
1.6 Applicability to Online Terrorist Support
Resolving exactly what mechanisms an accurate generative model of terrorism, in-
surgencies, or other forms of collective crime should include, will of course require
observing the inner workings of necessarily secretive activities – which will always
be practically impossible. Yet we have uncovered direct evidence that online ISIS
communities do indeed display the coalescence and fragmentation behaviors that
are central to the coalescence-fragmentation model of the Appendix and Fig. 3 [10].
We now explore this interesting connection between real-world (i.e. offline) ter-
rorism and insurgency, and the online world of support for such extremist activity,
by first setting it in context. Approximately half the world’s population (3 billion
people) use social media, with the dominant platform being Facebook. Each Face-
book user is typically a member of more than one Facebook group and a follower
of more than one Facebook page. Facebook and its international competitors such
as VKontakte, purposely design their online features to help bring together people
into relatively tight-knit clusters so that they can focus on some shared interest or
purpose. In this way, VKontakte in particular was used during the reign of ISIS,
to aggregate individuals with a potential interest in extremism – in particular, in
support of ISIS. Our research has shown that the key ingredient in the evolution
of online extremism lies in the particular many-body correlations that define these
tight-knit online clusters – in particular, the online pages and groups. Though me-
dia attention has focused on lone-wolf narratives, and it may very well be that a
single individual carries out such an attack, such individuals are likely to have had
some prior online exposure to pro-extremist narratives through access to these clus-
ters, i.e. pages and/or groups. So, the correct focus for understanding future attacks
likely lies in these cluster dynamics. After all, it would be wrong to pin the boiling
of water on what a single water molecule is doing, or on isolated molecules scattered
across the system. Instead the answer lies in their many-body behavior, specifically
the clustering of correlations. In the everyday world, taking apart every single car
on the planet would never help you explain how clusters of drivers interact to cause
traffic jams, or why traffic jams emerge universally in large cities.
While Facebook rapidly shut down pro-ISIS groups, its overseas competitors
were slower to act, probably because doing so would require significant amounts of
resources and time. The most important among these is VKontakte which has more
than 350 million users spread across the world, but which is physically based in the
politically sensitive area of Central Europe near ISIS’ major area of operations. Our
study of freely available, open-source information on VKontakte between January 1
and August 31, 2015 revealed an ultrafast ecology of 196 pro-ISIS groups that share
operational information and propaganda, involving 108,086 individual followers.
Although these online groups were typically shut down by online moderators within
a few weeks of being created, we found that their members would simply go on to
form another online group or join an existing online group that was still evading
shutdown. All of this information was freely available, because these online groups
need to attract newcomers and recruits, and hence their need for openness tends to
outweigh any risk of capture. There had been competing research work focusing on

10 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
analyzing extremism though messaging on Twitter, with the aim of identifying influ-
ential online individuals. However, such individual-level approaches met with only
limited success from a security perspective, in part because removing the individ-
ual ranked No. 1 from any extremist network automatically leads to the individual
ranked No. 2 becoming ranked No. 1, then the individual ranked No. 3 becoming
No. 2 etc.
Membership of these pro-ISIS online clusters changed on a daily timescale dur-
ing our study. On the most active day, the total number of follower links reached
134,857 since individual followers can become members of many separate groups.
This process of data collection, analysis and modeling provided us with a living
road map of online pro-ISIS activity. The high-resolution aspect of our data also
meant that this study moved beyond the current focus of the network science field
on identifying group structure in time-aggregated networks. Instead, we could see
followers? behavior in real time down to a timescale on the order of seconds. It also
moved the understanding of human dynamics beyond the current focus on quasi-
static links related to family or long-term friends, toward operationally-relevant dy-
namical interactions.
Figure 4 shows an example of the online group size (i.e. number of members in an
aggregate of users) as time increases, for three example online groups (i.e. clusters).
It turns out that this behavior in Fig. 4 is visibly almost the same as the evolution
of clusters in the coalescence-fragmentation model in the Appendix that produces
the power-law with exponent 2.5. Moreover, the empirical cluster size distribution is
also close to 2.5. The evolution of this online group ecosystem resembles dynamical
processes that had been observed in physics (e.g. polymers). However, unlike phys-
ical systems where individual units might break off from a group of molecules, or a
group of molecules might break into a few pieces, the fragmentation of these online
groups is like a shattering process reflecting the sudden moderator shutdown of an
online group (Fig. 3). The evolution of this online group ecosystem therefore seems
to follow the rather precise mathematical form of the Appendix. As the size – i.e. the
number of members – of each online group evolves over time, it produces a shark-
fin shape as shown in Fig. 4. In other words, these online groups of ISIS supporters
come together (coalescence) and break up (fragmentation) like fish in schools or
birds in a flock might. There is one difference though: when they break up, they
fragment completely because some external, anti-ISIS entity or online moderator
has shut them down (Fig. 3 fragmentation).
Hence the mathematical equations in the Appendix yield a distribution of group
sizes which is essentially the same as that observed in the online data, as well as
reproducing their characteristic shark-fin shapes in time (Fig. 4). There are many
practical consequences of these findings, as we now discuss. Identification of the
online group coalescence-fragmentation mechanism suggests that anti-ISIS agen-
cies can step in and break up small online groups before they develop into larger,
potentially powerful ones. If anti-ISIS agencies aren’t active enough in their coun-
termeasures, pro-ISIS support will quickly grow from a number of smaller online
groups into one super-group. It also warns that if online-group shutdown rates drop
below a certain critical value, any piece of pro-ISIS material will then be able to

1 Patterns in Terrorism and Insurgency 11
spread globally across the Internet – ultimately leading to an Internet arms race.
Moreover, we find that the birth-rate of these online groups escalates in a particular
way ahead of real-world mass onslaught, just as clusters of correlations begin to
proliferate ahead of a phase transition in a physical system, such as water boiling –
except this is now a dynamical phase transition in time. The important role of these
online groups also ties in nicely with earlier work that we did on guilds in the mas-
sively parallel online game World of Warcraft. Furthermore, it means that instead
of having to sift through millions of Internet users and track specific individuals
through controversial profiling techniques, an anti-ISIS agency can usefully shift its
focus toward open-source information to follow the relatively small number of on-
line groups in order to gauge what is happening in terms of hard-core global ISIS
support. As for the future, even if pro-ISIS support moves onto the dark net where
open access is not possible, or if a new entity beyond ISIS emerges, these findings
should still apply since they appear to capture a basic process of human collective
behavior. Independent of cause, we can assume that the same types of many-body
coalescence-fragmentation phenomena will arise.
Much remains to be done of course. Every day, there are undoubtedly individu-
als online developing the intent and capability to carry out further violent attacks.
So how might the many-body model in the Appendix and Fig. 3 help detect them
before they act? Suppose you meet someone in a university and you are interested
in knowing the next-step in their career. But instead of asking them their current
thoughts and getting a potentially vague answer since they themselves may not yet
know, you simply ask them what courses they have taken so far. This will then tell
you the spectrum of things that they have been exposed to, and hence you can nar-
row down what job they will likely end up in – perhaps better than they themselves
could at that stage. In an analogous way, such generalized many-body models, in
the hands of security specialists, could play a similar role for terrorism, extremism
and hate by seeing which individuals have passed through which groups and hence
likely have the necessary intent and capability.
1.7 Summary
We have presented a quantitative discussion of patterns that emerge from empirical
data on global terrorist events as well insurgencies, both of which are connected
to the broad topic of crime. We showed that such collective behavior can then be
cast into a set of mathematical equations which surprisingly have an exact solution
that in turn compares favorably to the empirical data for global terrorism, as well as
individual insurgencies. Turning to the online world, we also found good agreement
between the model and the behavior observed of supporters of terrorism.
Acknowledgements NFJ is very grateful to past students and post-docs who were part of this
research program and contributed to the understanding and results show here. These include Pedro
Manrique, Minzhang Zheng, Zhenfeng Cao and Andrew Gabriel.

12 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
Appendix
Here we consider the basic, one population version of our coalescence-fragmentation
model (Fig. 3) for some Red adversary. Instead of having clusters fragment when
interacting with Blue, or when sensing imminent danger, we simply assign a prob-
ability for them to fragment. The resulting model yields an exponentially cutoff
2.5-exponent power-law for the distribution of cluster sizes. Figure 5 summarizes
generalizations of this model that have appeared in the literature – in particular, Ref.
[15] contains a number of relevant generalizations, including a variable number of
agents in time N(t).
Assuming that the civilian population is just some passive background that ab-
sorbs the strength of each cluster when that cluster acts, the distribution of civilian
casualties should have a similar distribution to that of the insurgent cluster. Analysis
of a simple version of this model was completed earlier by d’Hulst and Rodgers
[16] – however the derivation below features general values nfrag and ncoal. At each
timestep, the internal coherence of a population of Nobjects (which we refer to as
an ‘agents’ to acknowledge application to human and/or cyber systems) comprises
a heterogenous soup of clusters. Within each cluster, the component objects have a
strong intra-cluster coherence. Between clusters, the inter-cluster coherence is weak.
An agent iis then picked at random – or equivalently, a cluster is randomly selected
with probability proportional to size. Let sibe the size of the cluster to which this
agent belongs. With probability nfrag, the coherence of a given cluster fragments
completely into siclusters of size one. If it doesn’t fragment, a second cluster is ran-
domly selected with probability again proportional to size – or equivalently, another
agent jis picked at random. With probability ncoal, the two clusters then coalesce
(or develop a common ‘coherence’ in terms of their thinking or activities). Kenney
provides a wealth of case-study support for thinking of an insurgency as a loose
soup of fragile clusters [17], as do Gambetta [18] and Robb [19].
The Master Equation is as follows:
∂ns
∂t=ncoal
N2
s1
Â
k=1
knk(sk)nsk
nfragsns
N2ncoalsns
N2
•
Â
k=1
knk,s2,(1.1)
∂n1
∂t=nfrag
N
•
Â
k=2
k2nk2ncoaln1
N2
•
Â
k=1
knk.(1.2)
Note here we make an approximation that N!•. The terms on the right hand side
of Eq. (1.1) represent all the ways in which nscan change. In the equilibrium state:
sns=ncoal
(nfrag +2ncoal)N
s1
Â
k=1
knk(sk)nsk,s2,(1.3)
n1=nfrag
2ncoal
•
Â
k=2
k2nk.(1.4)
Consider

1 Patterns in Terrorism and Insurgency 13
G[y]=
•
Â
k=0
knkyk=n1y+
•
Â
k=2
knkyk⌘n1y+g[y],(1.5)
where yis a parameter and g[y] governs the cluster size distribution nkfor k2.
Multiplying Eq. (1.3) by ysand then summing over sfrom 2 to •, yields:
g[y]= ncoal
(nfrag +2ncoal)NG[y],(1.6)
i.e.
g[y]2✓nfrag 2ncoal
ncoal
N2n1y◆g[y]+n2
1y2=0.(1.7)
From Eq. (1.5), g[1]=G[1]n1. Substituting this into Eq. (1.7) and setting y=1,
we can solve for g[1]
g[1]= ncoal
nfrag +2ncoal
N.(1.8)
Hence
n1=Ng[1]= nfrag +ncoal
nfrag +2ncoal
N.(1.9)
Substituting this into Eq. (1.7) yields
g[y]2✓nfrag +2ncoal
ncoal
N2N(nfrag +ncoal)
nfrag +2ncoal
y◆g[y]+(N(nfrag +ncoal))2
(nfrag +2ncoal)2y2=0.
(1.10)
We can solve this quadratic for g[y]
g[y]=(nfrag +2ncoal)N
4ncoal 24(nfrag +ncoal)ncoal
(nfrag +2ncoal)2y2s14(nfrag +ncoal )ncoal
(nfrag +2nfrag)2y!,
(1.11)
which can be easily expanded
g[y]=(nfrag +2ncoal)N
2ncoal
•
Â
k=2
(2k3)!!
(2k)!! ✓4(nfrag +ncoal)ncoal
(nfrag +2ncoal)2y◆k
.(1.12)
Comparing with the definition of g[y]in Eq. (1.5) shows that
ns=nfrag +2ncoal
2ncoal
(2s3)!!
s(2s)!! ✓4(nfrag +ncoal)ncoal
(nfrag +2ncoal)2◆s
.(1.13)
We now employ Stirling’s series
ln[s!]=1
2ln[2p]+✓s+1
2◆ln[s]s+1
12s... . (1.14)
Hence for s2, we find

14 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
ns⇡✓(nfrag +2ncoal)e2
23/2p2pncoal ◆✓4(nfrag +ncoal )ncoal
(nfrag +2ncoal)2◆s(s1)2s3/2
s2s+1N,(1.15)
which implies that
ns⇠ ns1
coal (nfrag +ncoal)s
(nfrag +2ncoal)2s1!s5/2.(1.16)
In the limit s1, this is formally equivalent to saying that
ns⇠exp(s/s0)s5/2(1.17)
where
s0=ln✓4(nfrag +ncoal)ncoal
(nfrag +2ncoal)2◆1
.(1.18)
For large cluster sizes (i.e. large ssuch that s⇠O(N)) the power law behavior is
masked by the exponential function. The equilibrium state for the distribution of
cluster sizes can therefore be considered a power-law with exponent a⇠5/2=2.5,
together with an exponential cut-off.
Generalizations are listed in Fig. 5, which confirm the robustness of this 2.5 re-
sult. However a wider variety of exponents very similar to the empirical findings
in Fig. 2, emerges if we allow a generalized form for the rigidity of clusters (i.e.
probability of a picked cluster coalescing or fragmenting) such that it depends on
size. In this case, the exponent is expected to vary typically from 1.5 to about 3.5,
which is consistent with the observed range in Fig. 2.
In the human context, the fact that the interactions are effectively distance-
independent as far as Eq. (A1) is concerned, captures the fact that we wish to
model systems where messages can be transmitted over arbitrary distances (e.g.
modern human communications). Bird calls and chimpanzee interactions in com-
plex tree canopy structures can also mimic this setup, as may the increasingly
longer-range awareness that arises in larger animal, fish, bird and insect groups.
In a human/biological context, a justification for choosing a cluster with a proba-
bility which is proportional to its size, is as follows: a cluster with more members
has more chances of initiating an event. It will also be more likely to find members
of another cluster more frequently, and hence be able to synchronize with them –
thereby synchronizing the two clusters. It is well documented that clusters of living
objects (e.g. animals, people) may suddenly scatter in all directions (i.e. complete
fragmentation as in Eq. (A1)) when its members sense danger, simply out of fear or
in order to confuse a predator.
References
1. I.D. Couzin, J. Krause, N.R. Franks, and S.A. Levin, Nature 433, 513 (2005)

1 Patterns in Terrorism and Insurgency 15
2. N.F. Johnson. Two’s Company, Three is Complexity (Oneworld Publishing, 2007)
3. N.F. Johnson, P. Jefferies, P.M. Hui. Financial Market Complexity (Oxford University Press,
Oxford, 2003)
4. N.F. Johnson, M. Spagat, J.A. Restrepo, O. Becerra, J.C. Bohorquez, N. Suarez, E.M. Re-
strepo, R. Zarama, Universal patterns in modern conflicts, e-print available at arxiv 0605035
(2006)
5. J.C. Bohorquez, S. Gourley, A.R. Dixon, M. Spagat, N.F. Johnson. Nature 462, 911 (2009)
6. N.F. Johnson, P. Medina, G. Zhao, D.S. Messinger, J. Horgan, P. Gill et al. Scientific Reports
3, 3463 (2013)
7. A. Clauset, M. Young, K.S. Gleditsch. Journal of Conflict Resolution 51 58 (2007)
8. A. Moghadam, R. Berger, P. Beliakova. Perspectives on Terrorism 8, 2 (2014)
9. M. Spagat, N.F. Johnson, S. Weezel. PLoS ONE 13, e0204639 (2018)
10. N.F. Johnson, M. Zheng, Y. Vorobyeva, A. Gabriel, H. Qi, N. Velasquez, et al. Science 352,
1459 (2016)
11. M.E.J. Newman, Contemporary Physics 46, 323 (2005)
12. R. Sundberg, E. Melander. Journal of Peace Research 50, 523 (2013)
13. K. Eck. Cooperation and Conflict 47, 124 (2012)
14. C.S. Gillespie. Journal of Statistical Software, July 1 (2014)
15. B. Ruszczycki, Z. Zhao, B. Burnett and N.F. Johnson. European Physical Journal 72, 289
(2009)
16. R. D’Hulst and G.J. Rodgers. International Journal of Theoretical and Applied Finance 3, 609
(2000)
17. M. Kenney, From Pablo to Osama: Trafficking and Terrorist Networks, Government Bureau-
cracies, and Competitive Adaptation (University Park: Pennsylvania State University Press,
2007)
18. D. Gambetta. Codes of the Underworld: How criminals communicate (Princeton University
Press, 2009)
19. J. Robb, Brave New War: The Next Stage of Terrorism and the End of Globalization (Wiley,
2007)

16 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
insurgency
(armed conflict)
terrorism
!
!
!
= 2.5
= 5/2
!
= 2.5
= 5/2
Fig. 1.2 Estimates of aparameter, along with 50 percent uncertainty interval, versus goodness-of-
fit pvalues for power-law hypotheses for (top) global violent armed conflicts and (bottom) terrorist
organizations. Grey shaded area corresponds to goodness-of-fit p0.05. Adapted from the authors
own original figure as appeared in Ref. [9], which permits unrestricted use under the terms of the
Creative Commons Attribution License.

1 Patterns in Terrorism and Insurgency 17
cells join
together
cells
fragment
Population could be a real world insurgency, terrorist group, criminal gang, Internet/
multimedia driven delinquency or rebellion, cyber-insurgency, cyber-terrorism group, online
criminal gang or informal collection of hackers
people may be
recruited or
converted at
each timestep
people may leave or
be captured/killed
at each timestep

N t
( )
: total strength at timestep t
Ngt
( )
: total number of cells at timestep t
where 1≤Ngt
( )
≤N t
( )
Both Ngt
( )
and N t
( )
may have
complex time - variation
clusters
coalesce
clusters
fragment
! " #"$ %&'$(
)* + , -./ 0 1
1 , 2 is product kernel 3 + , -./
1 , 4 is constant kernel 3 + , 4./
Fig. 1.3 Our model’s features which give the distribution of cluster sizes as a power-law (see
Appendix) with a=5/2=2.5. For a more general version (see Fig. 5), the clusters get chosen for
coalescence or fragmentation not proportionally to their size as in the treatment in the Appendix,
but instead according to their size to a power (1d). Hence d=0 is exactly the treatment in the
Appendix and is the so-called product kernel for coalescence, which gives a=5/2=2.5, while
d=1 is where size doesn’t matter and it is the so-called constant kernel for coalescence, which
gives a=3/2=1.5. As shown in Fig. 2, the range of a=1.5!3.5 corresponding to 1 d1,
does capture most of the real data for insurgencies and terrorism.

18 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo
Size of
online cluster
expressing
strong
pro-ISIS
support
! " ~"$ %.'
so * = 2.4
Fig. 1.4 Sizes of the online clusters showing strong support for ISIS during its growth period in
2014-2015, on the social media platform VKontakte [10]. This empirical data gives a size distri-
bution for the clusters, that is a power-law with high goodness-of-fit and has a=2.4 which is
remarkably close to the theoretical value in the Appendix and Fig. 3, as well as the results in Figs.
1,2. We think that it is particularly meaningful that the power-law distribution of the clusters of
ISIS supporters online is therefore essentially the same as the real world severities per event
caused by ISIS supporters in the real world: this suggests that the clusters act in events according
to some essentially stochastic external process, and when they do get involved then they tend to kill
numbers of people according to their size. Hence the distribution of cluster sizes of operating ISIS
fighters should indeed be similar to the distribution of ISIS severities (Fig. 1), which means that
the model in Fig. 3 and the Appendix provides a highly plausible description of ISIS supporters
online as well as those offline in the real world.

1 Patterns in Terrorism and Insurgency 19
Fig. 1.5 Summary of generalizations of the model in the Appendix, showing the robustness of the
a=2.5 result, and also how by introducing a dependence on picking clusters according to size,
the avalue can vary according to (2.5d)(see Fig. 3 caption discussion) and hence can explain
easily the fluctuations observed in Fig. 2.