Content uploaded by Stijn van Weezel

Author content

All content in this area was uploaded by Stijn van Weezel on Jun 11, 2019

Content may be subject to copyright.

Contents

Part I Part Title

1 Patterns in Terrorism and Insurgency: From real events and online

extremism to a generative mathematical model................... 3

Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson

Restrepo

1.1 Introduction.............................................. 4

1.2 Power Law Distributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

1.3 DataandAnalysis......................................... 6

1.4 EmpiricalFindings ........................................ 7

1.5 Discussion for Terrorism and Insurgency . . . . . . . . . . . . . . . . . . . . . . 8

1.6 Applicability to Online Terrorist Support . . . . . . . . . . . . . . . . . . . . . . 9

1.7 Summary ................................................ 11

Appendix...................................................... 12

References..................................................... 14

v

Chapter 1

Patterns in Terrorism and Insurgency:

From real events and online extremism to a

generative mathematical model

Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

Abstract We present a quantitative discussion of patterns that emerge from empiri-

cal data on global terrorist events as well insurgencies, both of which are inextrica-

bly linked to the broad topic of crime. Our interest is in the potential system-level

patterns, which would then suggest some kind of common collective mechanism.

We show that a mesoscopic view of plausible collective behavior by perpetrators,

can then be cast into a set of mathematical equations which have an exact solution.

This solution predicts a system level statistical signature that compares favorably to

the empirical data for global terrorism as well as individual insurgencies. Although

testing the dynamical features of this mathematical model would be hard in the real

world, due to its clandestine nature, we show that an opportunity arises in the online

world. Using this online data, we ﬁnd good agreement between the predictions of

the model and the collective behavior of online supporters. We discuss the robust-

ness and broader implications of our ﬁndings.

Neil F. Johnson

Physics Department, George Washington University, Washington D.C. 20052, U.S.A., e-mail:

neiljohnson@gwu.edu

Stijn van Weezel

School of Economics, University College Dublin, Leinster, Ireland e-mail: weezel.van@gmail.com

Michael Spagat

Department of Economics, Royal Holloway University of London, Egham, Surrey, U.K.e-mail:

M.Spagat@rhul.ac.uk

Dylan Johnson Restrepo

Physics Department, George Washington University, Washington D.C. 20052, U.S.A., e-mail: ddy-

lanj@icloud.com

3

4 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

1.1 Introduction

The ability to determine some deep structure to terrorist campaigns and insurgen-

cies could, in principle, enable more reliable prediction of future patterns of violent

events. This is a momentous task, and one that could seem doomed to failure given

the haphazard, almost random record of violent events that is reported nightly on

the news from across the globe. However, it is the topic that we pursue here and for

which we share some intriguing glimpses of success. As part of this, our focus in

this chapter is on collective phenomena: ﬁrst, this is because we believe that one-

off attacks by an individual who is acting entirely alone, are less likely to produce

any surprising new patterns at the system level of the entire population. Second, we

believe that if there are interesting patterns, then they are more likely to emerge in

activities that involve a larger collection of people. Just as trafﬁc jam patterns are

known to occur similarly in cities across the world, despite the differences in the

people involved, the mechanical details of their cars, and the environmental factors,

it seems that the sheer fact of having to self-organize in a way that avoids being

found out or apprehended, might lie behind some hidden systematic patterns. In

short, just as two is company and three is a crowd [1, 2, 3]. the crowd behavior of

how humans collectively ‘do’ terrorism and insurgency – and hence in general com-

mit violent acts – might be expected show some form of universality. As we show

here, this indeed seems to be the case.

In the rest of this chapter, we examine the patterns that emerge in terrorism and

insurgencies. We then present a set of mathematical model for this collective behav-

ior. We show that the associated equations have an exact solution which provides

a system level statistical signature. We show that this statistical signature compares

favorably to the empirical data for global terrorism as well as individual insurgen-

cies [4, 7, 5, 6]. We note that there is still much debate in the literature about the

lack of distinction between terrorism and insurgency (and also crime versus domes-

tic terrorism) [8] and so the fact that we ﬁnd similar patterns for both is reassuring

and aligns with this blurring of deﬁnitions. Though testing the dynamical features of

this mathematical model is hard in the real world, due in part to the clandestine na-

ture of such activities and hence human groups, we then discuss how turning to the

online world, provides a new laboratory for such a test. There is surprisingly good

agreement between the behavior of the model over time, and the behavior observed

of online groups of supporters of terrorism. We end by discussing the robustness

and broader implications of our ﬁndings.

1.2 Power Law Distributions

Our approach is very much akin to that of astronomy, and indeed much of physics,

in that we start with no theoretical hypothesis and instead simply observe the data,

taking in as much as we can into our analysis as opposed to simply sampling from

1 Patterns in Terrorism and Insurgency 5

it. Then we look for statistical patterns in this large dataset. Much of our analysis

comes from more detailed reports which can be accessed at Refs. [9, 5, 6, 10].

The particular statistical pattern that we will test for, is a so-called power-law dis-

tribution [11] of severity of violent events. This is because a power-law distribution

emerges frequently in the study of collective behavior in systems of interacting ob-

jects (which could include humans) when there are complex feedback mechanisms

at play. We have every reason to believe that in violent events such as terrorism,

there will likely be such feedback processes at work during the preparation and exe-

cution of the attack. The opposite case to this is a process that has no feedback, like

the outcome from tossing a coin. This is well-known to produce a bell curve, which

is another term for a Normal distribution [11]. A power-law distribution therefore

has very different implications to a Normal distribution.

To explain the signiﬁcance of a power-law, imagine we know the heights of all

the adults in our street, city, or country. If we then make a graph of the distribution

of these heights, we will get an approximate bell curve. Since no-one is 12 feet tall,

and no-one is less than a foot tall, it makes sense that the curve will rise up and

then drop back down again, peaking around a mean height of say 5 feet 7 inches.

This peak occurs at the height which describes the largest number of people and

therefore represents the typical, or average, height of humans. There is a good rea-

son why, like heights, many systems produce a Normal distribution: in each case,

the average value of the quantity being measured is dictated by something intrinsic

to the individuals themselves, and hence something structural and pre-determined,

while the spread (or so-called, ﬂuctuation) in values around this average is usually

due to environmental ad hoc reasons. As far as adult heights go, a person’s body has

an implicit reason based on genes and inheritance to grow to a certain approximate

height. Then if the person has an extreme oversupply or undersupply of nutrition,

they will probably end up somewhere just above or below this value. By contrast,

however, there are many social, economic and biological systems – including the

distribution of the number of events (attacks) in an insurgency or terrorism with s

casualties – which do not follow a peaked distribution, but instead resemble far more

closely the distribution called a power law which has the form p(s)=Msawhere

Mis a constant, sis the size of the event (i.e. severity in our analysis, which is the

number killed in the event), and ais called the power-law exponent [11]. Plotting

such a distribution on log-log paper would, by taking the logarithm of both sides,

produce an approximate straight line with a negative slope of magnitude a[11]. If,

as we ﬁnd, violent events in terrorism and insurgencies follow a power law, this has

some important consequences as compared to the bell-curve distribution. First, the

most frequent incidents will be ones with fewest fatalities, unlike the case of peo-

ple’s heights. Second, very deadly events with many fatalities will occur – rarely,

but they will occur. This is unlike the case of heights, where the chances are zero

that someone will be taller than 12 feet. For this reason, planning for violent events

is inherently a complex task.

6 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

1.3 Data and Analysis

In our analysis the size sof a discrete event, such as a suicide bombing or an attack,

is deﬁned as the number of people killed in the event, which is termed the severity

of the event. To produce Figs. 1 and 2, we analyzed the new event data on armed

conﬂict and terrorism. Speciﬁcally, our armed-conﬂict data comes from the Georef-

erenced Event Dataset (GED) of the Uppsala Conﬂict Data Programme [12] which

is the most accurate and comprehensive georeferenced dataset available [13]. We

also performed a parallel analysis of terrorist incidents, using the Global Terrorism

Database (GTD, the 2017 version), which is provided by the National Consortium

for the Study of Terrorism and Responses to Terrorism (START). The GTD dataset

includes both domestic and trans/inter-national terrorist incidents. The GTD is up-

dated annually and provides the most comprehensive dataset on terrorist events that

is publicly available, covering the period from 1970 to 2016 and including detailed

information on incident times, locations, fatality counts and, when identiﬁable, the

perpetrating group or individual. We include only events that are, according to the

coding, deﬁnitely acts of terrorism causing at least one fatality and that are attributed

to a known organization that has perpetrated at least 30 attacks. Finally, we use only

100101102

100

10-1

10-2

10-3

Size s (i.e. number of casualties) of violent event

ISIS: ! " ≈ "$% for s ≥smin

Power-law exponent ' = 2.5

smin = 15

Goodness-of-fit p = 0.70

Cumulative total number of violent events

Fig. 1.1 Fitted power law for attacks involving ISIS. Event sizes measured as number of people

killed, are plotted on the x-axis against the number of events of that size or larger on the y axis.

Here for convenience we show the cumulative total, but this does not affect the resulting analysis

or the resulting avalue. Red solid line indicates the power law.

1 Patterns in Terrorism and Insurgency 7

events occurring after 1997 because the GTD coding procedures changed in that

year. This leaves us with 16,399 terrorist attacks carried out by 60 groups between

1998 2016.

We use the poweRlaw software package in R [14] to ﬁt the model Msato the

distributions of the event severities above an estimated cut-off value smin using max-

imum likelihood estimation. The smin parameter, the lower threshold, is estimated

using a Kolmogorov-Smirnov approach, where the distance between the cumula-

tive density function of the data and the ﬁtted model is minimized. To account for

parameter uncertainty, the estimates are obtained using a bootstrap procedure with

1,000 iterations.

1.4 Empirical Findings

Figure 1 provides an example of a power law ﬁt to the attacks by ISIS (Islamic State

of Iraq and the Levant). The ﬁt is remarkably good, and has a high goodness of ﬁt.

It yields an empirical value a=2.5. Figure 2 (top) plots the estimated avalues

for the 273 conﬂicts in our sample against the p-values of bootstrapped tests of the

hypotheses that their data are generated by the ﬁtted power laws for these conﬂicts;

here the null hypothesis is that the power law distribution cannot be ruled out. Most

conﬂicts do have size distributions for their violent events that are well ﬁt by power

laws with coefﬁcients clustering around 2.5. At the same time, some conﬂicts do

display avalues far from 2.5, and some conﬂicts have very low goodness of ﬁt p-

values. However, low p-values are not necessarily that relevant since no distribution

of violent conﬂict events will be exactly generated by an exact power law, so we

would normally expect to reject the power-law hypothesis with enough data even

when this distribution is still useful for modeling the event-generating process of a

conﬂict. Estimated a’s far from 2.5 could stem from data problems, e.g. not having

enough data or having serious ﬂaws in the data-gathering processes for particular

conﬂicts.

Figure 2 (bottom) provides the same sort of pversus ainformation, but now

for terrorist groups using the GTD data. Note that the nature of these results is

substantially different from earlier work ﬁtting power laws to global terrorist events

[7] because we ﬁt a separate power law to each terrorist organization whereas the

previous work merged together all the events generated by all terrorist organizations.

It shows that power laws with avalues that cluster around 2.5 also tend to ﬁt well

the distributions of violent events generated by terrorist organizations. Thus, there

appear to be close parallels in the behavior of terrorist and insurgent organizations, at

least with respect to the processes that generate their violent events. This empirical

commonality is reassuring given the blurred distinctions between the two types of

organizations [8].

8 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

1.5 Discussion for Terrorism and Insurgency

We have hence found that the size distribution of violent events in modern conﬂicts

and terrorist campaigns are generally well approximated by power laws with aco-

efﬁcients clustered near 2.5. There are some exceptions, though these exceptions

also tend to have large uncertainties in the values of their coefﬁcients. It will be in-

teresting in the future to look in detail at what might make these few conﬂicts and

campaigns so different.

One could use the empirical ﬁndings concerning the power-law testing and ex-

ponent, as a way of evaluating the appropriateness of models that seek a genera-

tive, minimalistic explanation of human conﬂict. Among these, is the coalescence-

fragmentation model originally proposed in Ref. [5] in which two populations ﬁght,

and which takes into account the tendency of clusters of insurgents to assemble

for clashes or attacks and then disperse afterwards. It was shown in Ref. [5] that

this two-population model gives very good agreement for the entire distribution of

casualties in various conﬂicts not just the approximate power-law tail, but also the

low-casualty and high-casualty deviations. If one is interested only in examining the

tail of the distribution, as we do in the present paper, then a simpler version of this

theory is possible in which the dynamical clustering is treated as a stochastic noise

term. This is shown explicitly in the Appendix and Fig. 3. In this case, the effect

of this co-existing coalescence and fragmentation of clusters of ﬁghters produces a

distribution of cluster sizes that has a robust power-law form with a mathematically

derivable exponent of 2.5 (see Fig. 3). Taking the size of a cluster as a measure of

its potential for damage, this suggests that the distribution of casualties should also

be a power-law with exponent around 2.5, exactly as observed for ISIS for example

in Fig. 1. As ﬁrst explained in 2005 [4], this model corresponds to the picture that

an organization’s total attack strength Nis continually being re-partitioned through

coalescence and fragmentation events. The value of this attack strength Nderives

from the number of its members, its weaponry, its information etc. and hence does

not lead to the conclusion that the size of the organization bounds the severity in any

way (Fig. 3).

The simple, one population version of this model is given in the Appendix where

it is shown how the exponent value of 2.5 emerges directly. It also indicates that

a generalization of this model, where the robustness of larger clusters is allowed

to depend on sin a richer way, produces the variation seen in the empirical data

in Fig. 2 [6]. Though we ﬁrst presented this simple model explanation in 2005, to

this day we still know of no other model that provides such a plausible microscopic

mechanism, and yet which also predicts a clustering of power-law exponents around

2.5 without speciﬁcally cherry-picking model parameter values.

1 Patterns in Terrorism and Insurgency 9

1.6 Applicability to Online Terrorist Support

Resolving exactly what mechanisms an accurate generative model of terrorism, in-

surgencies, or other forms of collective crime should include, will of course require

observing the inner workings of necessarily secretive activities – which will always

be practically impossible. Yet we have uncovered direct evidence that online ISIS

communities do indeed display the coalescence and fragmentation behaviors that

are central to the coalescence-fragmentation model of the Appendix and Fig. 3 [10].

We now explore this interesting connection between real-world (i.e. ofﬂine) ter-

rorism and insurgency, and the online world of support for such extremist activity,

by ﬁrst setting it in context. Approximately half the world’s population (3 billion

people) use social media, with the dominant platform being Facebook. Each Face-

book user is typically a member of more than one Facebook group and a follower

of more than one Facebook page. Facebook and its international competitors such

as VKontakte, purposely design their online features to help bring together people

into relatively tight-knit clusters so that they can focus on some shared interest or

purpose. In this way, VKontakte in particular was used during the reign of ISIS,

to aggregate individuals with a potential interest in extremism – in particular, in

support of ISIS. Our research has shown that the key ingredient in the evolution

of online extremism lies in the particular many-body correlations that deﬁne these

tight-knit online clusters – in particular, the online pages and groups. Though me-

dia attention has focused on lone-wolf narratives, and it may very well be that a

single individual carries out such an attack, such individuals are likely to have had

some prior online exposure to pro-extremist narratives through access to these clus-

ters, i.e. pages and/or groups. So, the correct focus for understanding future attacks

likely lies in these cluster dynamics. After all, it would be wrong to pin the boiling

of water on what a single water molecule is doing, or on isolated molecules scattered

across the system. Instead the answer lies in their many-body behavior, speciﬁcally

the clustering of correlations. In the everyday world, taking apart every single car

on the planet would never help you explain how clusters of drivers interact to cause

trafﬁc jams, or why trafﬁc jams emerge universally in large cities.

While Facebook rapidly shut down pro-ISIS groups, its overseas competitors

were slower to act, probably because doing so would require signiﬁcant amounts of

resources and time. The most important among these is VKontakte which has more

than 350 million users spread across the world, but which is physically based in the

politically sensitive area of Central Europe near ISIS’ major area of operations. Our

study of freely available, open-source information on VKontakte between January 1

and August 31, 2015 revealed an ultrafast ecology of 196 pro-ISIS groups that share

operational information and propaganda, involving 108,086 individual followers.

Although these online groups were typically shut down by online moderators within

a few weeks of being created, we found that their members would simply go on to

form another online group or join an existing online group that was still evading

shutdown. All of this information was freely available, because these online groups

need to attract newcomers and recruits, and hence their need for openness tends to

outweigh any risk of capture. There had been competing research work focusing on

10 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

analyzing extremism though messaging on Twitter, with the aim of identifying inﬂu-

ential online individuals. However, such individual-level approaches met with only

limited success from a security perspective, in part because removing the individ-

ual ranked No. 1 from any extremist network automatically leads to the individual

ranked No. 2 becoming ranked No. 1, then the individual ranked No. 3 becoming

No. 2 etc.

Membership of these pro-ISIS online clusters changed on a daily timescale dur-

ing our study. On the most active day, the total number of follower links reached

134,857 since individual followers can become members of many separate groups.

This process of data collection, analysis and modeling provided us with a living

road map of online pro-ISIS activity. The high-resolution aspect of our data also

meant that this study moved beyond the current focus of the network science ﬁeld

on identifying group structure in time-aggregated networks. Instead, we could see

followers? behavior in real time down to a timescale on the order of seconds. It also

moved the understanding of human dynamics beyond the current focus on quasi-

static links related to family or long-term friends, toward operationally-relevant dy-

namical interactions.

Figure 4 shows an example of the online group size (i.e. number of members in an

aggregate of users) as time increases, for three example online groups (i.e. clusters).

It turns out that this behavior in Fig. 4 is visibly almost the same as the evolution

of clusters in the coalescence-fragmentation model in the Appendix that produces

the power-law with exponent 2.5. Moreover, the empirical cluster size distribution is

also close to 2.5. The evolution of this online group ecosystem resembles dynamical

processes that had been observed in physics (e.g. polymers). However, unlike phys-

ical systems where individual units might break off from a group of molecules, or a

group of molecules might break into a few pieces, the fragmentation of these online

groups is like a shattering process reﬂecting the sudden moderator shutdown of an

online group (Fig. 3). The evolution of this online group ecosystem therefore seems

to follow the rather precise mathematical form of the Appendix. As the size – i.e. the

number of members – of each online group evolves over time, it produces a shark-

ﬁn shape as shown in Fig. 4. In other words, these online groups of ISIS supporters

come together (coalescence) and break up (fragmentation) like ﬁsh in schools or

birds in a ﬂock might. There is one difference though: when they break up, they

fragment completely because some external, anti-ISIS entity or online moderator

has shut them down (Fig. 3 fragmentation).

Hence the mathematical equations in the Appendix yield a distribution of group

sizes which is essentially the same as that observed in the online data, as well as

reproducing their characteristic shark-ﬁn shapes in time (Fig. 4). There are many

practical consequences of these ﬁndings, as we now discuss. Identiﬁcation of the

online group coalescence-fragmentation mechanism suggests that anti-ISIS agen-

cies can step in and break up small online groups before they develop into larger,

potentially powerful ones. If anti-ISIS agencies aren’t active enough in their coun-

termeasures, pro-ISIS support will quickly grow from a number of smaller online

groups into one super-group. It also warns that if online-group shutdown rates drop

below a certain critical value, any piece of pro-ISIS material will then be able to

1 Patterns in Terrorism and Insurgency 11

spread globally across the Internet – ultimately leading to an Internet arms race.

Moreover, we ﬁnd that the birth-rate of these online groups escalates in a particular

way ahead of real-world mass onslaught, just as clusters of correlations begin to

proliferate ahead of a phase transition in a physical system, such as water boiling –

except this is now a dynamical phase transition in time. The important role of these

online groups also ties in nicely with earlier work that we did on guilds in the mas-

sively parallel online game World of Warcraft. Furthermore, it means that instead

of having to sift through millions of Internet users and track speciﬁc individuals

through controversial proﬁling techniques, an anti-ISIS agency can usefully shift its

focus toward open-source information to follow the relatively small number of on-

line groups in order to gauge what is happening in terms of hard-core global ISIS

support. As for the future, even if pro-ISIS support moves onto the dark net where

open access is not possible, or if a new entity beyond ISIS emerges, these ﬁndings

should still apply since they appear to capture a basic process of human collective

behavior. Independent of cause, we can assume that the same types of many-body

coalescence-fragmentation phenomena will arise.

Much remains to be done of course. Every day, there are undoubtedly individu-

als online developing the intent and capability to carry out further violent attacks.

So how might the many-body model in the Appendix and Fig. 3 help detect them

before they act? Suppose you meet someone in a university and you are interested

in knowing the next-step in their career. But instead of asking them their current

thoughts and getting a potentially vague answer since they themselves may not yet

know, you simply ask them what courses they have taken so far. This will then tell

you the spectrum of things that they have been exposed to, and hence you can nar-

row down what job they will likely end up in – perhaps better than they themselves

could at that stage. In an analogous way, such generalized many-body models, in

the hands of security specialists, could play a similar role for terrorism, extremism

and hate by seeing which individuals have passed through which groups and hence

likely have the necessary intent and capability.

1.7 Summary

We have presented a quantitative discussion of patterns that emerge from empirical

data on global terrorist events as well insurgencies, both of which are connected

to the broad topic of crime. We showed that such collective behavior can then be

cast into a set of mathematical equations which surprisingly have an exact solution

that in turn compares favorably to the empirical data for global terrorism, as well as

individual insurgencies. Turning to the online world, we also found good agreement

between the model and the behavior observed of supporters of terrorism.

Acknowledgements NFJ is very grateful to past students and post-docs who were part of this

research program and contributed to the understanding and results show here. These include Pedro

Manrique, Minzhang Zheng, Zhenfeng Cao and Andrew Gabriel.

12 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

Appendix

Here we consider the basic, one population version of our coalescence-fragmentation

model (Fig. 3) for some Red adversary. Instead of having clusters fragment when

interacting with Blue, or when sensing imminent danger, we simply assign a prob-

ability for them to fragment. The resulting model yields an exponentially cutoff

2.5-exponent power-law for the distribution of cluster sizes. Figure 5 summarizes

generalizations of this model that have appeared in the literature – in particular, Ref.

[15] contains a number of relevant generalizations, including a variable number of

agents in time N(t).

Assuming that the civilian population is just some passive background that ab-

sorbs the strength of each cluster when that cluster acts, the distribution of civilian

casualties should have a similar distribution to that of the insurgent cluster. Analysis

of a simple version of this model was completed earlier by d’Hulst and Rodgers

[16] – however the derivation below features general values nfrag and ncoal. At each

timestep, the internal coherence of a population of Nobjects (which we refer to as

an ‘agents’ to acknowledge application to human and/or cyber systems) comprises

a heterogenous soup of clusters. Within each cluster, the component objects have a

strong intra-cluster coherence. Between clusters, the inter-cluster coherence is weak.

An agent iis then picked at random – or equivalently, a cluster is randomly selected

with probability proportional to size. Let sibe the size of the cluster to which this

agent belongs. With probability nfrag, the coherence of a given cluster fragments

completely into siclusters of size one. If it doesn’t fragment, a second cluster is ran-

domly selected with probability again proportional to size – or equivalently, another

agent jis picked at random. With probability ncoal, the two clusters then coalesce

(or develop a common ‘coherence’ in terms of their thinking or activities). Kenney

provides a wealth of case-study support for thinking of an insurgency as a loose

soup of fragile clusters [17], as do Gambetta [18] and Robb [19].

The Master Equation is as follows:

∂ns

∂t=ncoal

N2

s1

Â

k=1

knk(sk)nsk

nfragsns

N2ncoalsns

N2

•

Â

k=1

knk,s2,(1.1)

∂n1

∂t=nfrag

N

•

Â

k=2

k2nk2ncoaln1

N2

•

Â

k=1

knk.(1.2)

Note here we make an approximation that N!•. The terms on the right hand side

of Eq. (1.1) represent all the ways in which nscan change. In the equilibrium state:

sns=ncoal

(nfrag +2ncoal)N

s1

Â

k=1

knk(sk)nsk,s2,(1.3)

n1=nfrag

2ncoal

•

Â

k=2

k2nk.(1.4)

Consider

1 Patterns in Terrorism and Insurgency 13

G[y]=

•

Â

k=0

knkyk=n1y+

•

Â

k=2

knkyk⌘n1y+g[y],(1.5)

where yis a parameter and g[y] governs the cluster size distribution nkfor k2.

Multiplying Eq. (1.3) by ysand then summing over sfrom 2 to •, yields:

g[y]= ncoal

(nfrag +2ncoal)NG[y],(1.6)

i.e.

g[y]2✓nfrag 2ncoal

ncoal

N2n1y◆g[y]+n2

1y2=0.(1.7)

From Eq. (1.5), g[1]=G[1]n1. Substituting this into Eq. (1.7) and setting y=1,

we can solve for g[1]

g[1]= ncoal

nfrag +2ncoal

N.(1.8)

Hence

n1=Ng[1]= nfrag +ncoal

nfrag +2ncoal

N.(1.9)

Substituting this into Eq. (1.7) yields

g[y]2✓nfrag +2ncoal

ncoal

N2N(nfrag +ncoal)

nfrag +2ncoal

y◆g[y]+(N(nfrag +ncoal))2

(nfrag +2ncoal)2y2=0.

(1.10)

We can solve this quadratic for g[y]

g[y]=(nfrag +2ncoal)N

4ncoal 24(nfrag +ncoal)ncoal

(nfrag +2ncoal)2y2s14(nfrag +ncoal )ncoal

(nfrag +2nfrag)2y!,

(1.11)

which can be easily expanded

g[y]=(nfrag +2ncoal)N

2ncoal

•

Â

k=2

(2k3)!!

(2k)!! ✓4(nfrag +ncoal)ncoal

(nfrag +2ncoal)2y◆k

.(1.12)

Comparing with the deﬁnition of g[y]in Eq. (1.5) shows that

ns=nfrag +2ncoal

2ncoal

(2s3)!!

s(2s)!! ✓4(nfrag +ncoal)ncoal

(nfrag +2ncoal)2◆s

.(1.13)

We now employ Stirling’s series

ln[s!]=1

2ln[2p]+✓s+1

2◆ln[s]s+1

12s... . (1.14)

Hence for s2, we ﬁnd

14 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

ns⇡✓(nfrag +2ncoal)e2

23/2p2pncoal ◆✓4(nfrag +ncoal )ncoal

(nfrag +2ncoal)2◆s(s1)2s3/2

s2s+1N,(1.15)

which implies that

ns⇠ ns1

coal (nfrag +ncoal)s

(nfrag +2ncoal)2s1!s5/2.(1.16)

In the limit s1, this is formally equivalent to saying that

ns⇠exp(s/s0)s5/2(1.17)

where

s0=ln✓4(nfrag +ncoal)ncoal

(nfrag +2ncoal)2◆1

.(1.18)

For large cluster sizes (i.e. large ssuch that s⇠O(N)) the power law behavior is

masked by the exponential function. The equilibrium state for the distribution of

cluster sizes can therefore be considered a power-law with exponent a⇠5/2=2.5,

together with an exponential cut-off.

Generalizations are listed in Fig. 5, which conﬁrm the robustness of this 2.5 re-

sult. However a wider variety of exponents very similar to the empirical ﬁndings

in Fig. 2, emerges if we allow a generalized form for the rigidity of clusters (i.e.

probability of a picked cluster coalescing or fragmenting) such that it depends on

size. In this case, the exponent is expected to vary typically from 1.5 to about 3.5,

which is consistent with the observed range in Fig. 2.

In the human context, the fact that the interactions are effectively distance-

independent as far as Eq. (A1) is concerned, captures the fact that we wish to

model systems where messages can be transmitted over arbitrary distances (e.g.

modern human communications). Bird calls and chimpanzee interactions in com-

plex tree canopy structures can also mimic this setup, as may the increasingly

longer-range awareness that arises in larger animal, ﬁsh, bird and insect groups.

In a human/biological context, a justiﬁcation for choosing a cluster with a proba-

bility which is proportional to its size, is as follows: a cluster with more members

has more chances of initiating an event. It will also be more likely to ﬁnd members

of another cluster more frequently, and hence be able to synchronize with them –

thereby synchronizing the two clusters. It is well documented that clusters of living

objects (e.g. animals, people) may suddenly scatter in all directions (i.e. complete

fragmentation as in Eq. (A1)) when its members sense danger, simply out of fear or

in order to confuse a predator.

References

1. I.D. Couzin, J. Krause, N.R. Franks, and S.A. Levin, Nature 433, 513 (2005)

1 Patterns in Terrorism and Insurgency 15

2. N.F. Johnson. Two’s Company, Three is Complexity (Oneworld Publishing, 2007)

3. N.F. Johnson, P. Jefferies, P.M. Hui. Financial Market Complexity (Oxford University Press,

Oxford, 2003)

4. N.F. Johnson, M. Spagat, J.A. Restrepo, O. Becerra, J.C. Bohorquez, N. Suarez, E.M. Re-

strepo, R. Zarama, Universal patterns in modern conﬂicts, e-print available at arxiv 0605035

(2006)

5. J.C. Bohorquez, S. Gourley, A.R. Dixon, M. Spagat, N.F. Johnson. Nature 462, 911 (2009)

6. N.F. Johnson, P. Medina, G. Zhao, D.S. Messinger, J. Horgan, P. Gill et al. Scientiﬁc Reports

3, 3463 (2013)

7. A. Clauset, M. Young, K.S. Gleditsch. Journal of Conﬂict Resolution 51 58 (2007)

8. A. Moghadam, R. Berger, P. Beliakova. Perspectives on Terrorism 8, 2 (2014)

9. M. Spagat, N.F. Johnson, S. Weezel. PLoS ONE 13, e0204639 (2018)

10. N.F. Johnson, M. Zheng, Y. Vorobyeva, A. Gabriel, H. Qi, N. Velasquez, et al. Science 352,

1459 (2016)

11. M.E.J. Newman, Contemporary Physics 46, 323 (2005)

12. R. Sundberg, E. Melander. Journal of Peace Research 50, 523 (2013)

13. K. Eck. Cooperation and Conﬂict 47, 124 (2012)

14. C.S. Gillespie. Journal of Statistical Software, July 1 (2014)

15. B. Ruszczycki, Z. Zhao, B. Burnett and N.F. Johnson. European Physical Journal 72, 289

(2009)

16. R. D’Hulst and G.J. Rodgers. International Journal of Theoretical and Applied Finance 3, 609

(2000)

17. M. Kenney, From Pablo to Osama: Trafﬁcking and Terrorist Networks, Government Bureau-

cracies, and Competitive Adaptation (University Park: Pennsylvania State University Press,

2007)

18. D. Gambetta. Codes of the Underworld: How criminals communicate (Princeton University

Press, 2009)

19. J. Robb, Brave New War: The Next Stage of Terrorism and the End of Globalization (Wiley,

2007)

16 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

insurgency

(armed conflict)

terrorism

!

!

!

= 2.5

= 5/2

!

= 2.5

= 5/2

Fig. 1.2 Estimates of aparameter, along with 50 percent uncertainty interval, versus goodness-of-

ﬁt pvalues for power-law hypotheses for (top) global violent armed conﬂicts and (bottom) terrorist

organizations. Grey shaded area corresponds to goodness-of-ﬁt p0.05. Adapted from the authors

own original ﬁgure as appeared in Ref. [9], which permits unrestricted use under the terms of the

Creative Commons Attribution License.

1 Patterns in Terrorism and Insurgency 17

cells join

together

cells

fragment

Population could be a real world insurgency, terrorist group, criminal gang, Internet/

multimedia driven delinquency or rebellion, cyber-insurgency, cyber-terrorism group, online

criminal gang or informal collection of hackers

people may be

recruited or

converted at

each timestep

people may leave or

be captured/killed

at each timestep

N t

( )

: total strength at timestep t

Ngt

( )

: total number of cells at timestep t

where 1≤Ngt

( )

≤N t

( )

Both Ngt

( )

and N t

( )

may have

complex time - variation

clusters

coalesce

clusters

fragment

! " #"$ %&'$(

)* + , -./ 0 1

1 , 2 is product kernel 3 + , -./

1 , 4 is constant kernel 3 + , 4./

Fig. 1.3 Our model’s features which give the distribution of cluster sizes as a power-law (see

Appendix) with a=5/2=2.5. For a more general version (see Fig. 5), the clusters get chosen for

coalescence or fragmentation not proportionally to their size as in the treatment in the Appendix,

but instead according to their size to a power (1d). Hence d=0 is exactly the treatment in the

Appendix and is the so-called product kernel for coalescence, which gives a=5/2=2.5, while

d=1 is where size doesn’t matter and it is the so-called constant kernel for coalescence, which

gives a=3/2=1.5. As shown in Fig. 2, the range of a=1.5!3.5 corresponding to 1 d1,

does capture most of the real data for insurgencies and terrorism.

18 Neil F. Johnson, Stijn van Weezel, Michael Spagat and Dylan Johnson Restrepo

Size of

online cluster

expressing

strong

pro-ISIS

support

! " ~"$ %.'

so * = 2.4

Fig. 1.4 Sizes of the online clusters showing strong support for ISIS during its growth period in

2014-2015, on the social media platform VKontakte [10]. This empirical data gives a size distri-

bution for the clusters, that is a power-law with high goodness-of-ﬁt and has a=2.4 which is

remarkably close to the theoretical value in the Appendix and Fig. 3, as well as the results in Figs.

1,2. We think that it is particularly meaningful that the power-law distribution of the clusters of

ISIS supporters online is therefore essentially the same as the real world severities per event

caused by ISIS supporters in the real world: this suggests that the clusters act in events according

to some essentially stochastic external process, and when they do get involved then they tend to kill

numbers of people according to their size. Hence the distribution of cluster sizes of operating ISIS

ﬁghters should indeed be similar to the distribution of ISIS severities (Fig. 1), which means that

the model in Fig. 3 and the Appendix provides a highly plausible description of ISIS supporters

online as well as those ofﬂine in the real world.

1 Patterns in Terrorism and Insurgency 19

Fig. 1.5 Summary of generalizations of the model in the Appendix, showing the robustness of the

a=2.5 result, and also how by introducing a dependence on picking clusters according to size,

the avalue can vary according to (2.5d)(see Fig. 3 caption discussion) and hence can explain

easily the ﬂuctuations observed in Fig. 2.