Universality and correlations in individuals wandering through an online extremist space

TL;DR

This study uses stochastic walk physics to analyze online trajectories of social media users, revealing universal patterns and correlations that distinguish individuals likely to develop extremist support.

Contribution

It introduces a unifying theoretical framework based on stochastic walks to describe online user trajectories and their relation to extremism development.

Findings

Universal online lifetime characteristics identified

Theoretical solutions describe trajectories of extremists and non-extremists

Correlations suggest physics tools can quantify extremism risk

Abstract

The 'out of the blue' nature of recent terror attacks and the diversity of apparent motives, highlight the importance of understanding the online trajectories that individuals follow prior to developing high levels of extremist support. Here we show that the physics of stochastic walks, with and without temporal correlation, provides a unifying description of these online trajectories. Our unique dataset comprising all users of a global social media site, reveals universal characteristics in individuals' online lifetimes. Our accompanying theory generates analytical and numerical solutions that describe the characteristics shown by individuals that go on to develop high levels of extremist support, and those that do not. The existence of these temporal and also many-body correlations suggests that existing physics machinery can be used to quantify and perhaps mitigate the risk of future events.

Equations

$$\{\begin{array}{ll}& (\frac{\partial }{dt}-D\frac{{\partial }^2}{\partial x^2}+u\frac{\partial }{\partial x})G(x,t;x_0,t_0)=0\\ & G(x,t;x_0,t_0)=\delta (x-x_0)\delta (t-t_0)\\ & G(b,t;x_0,t_0)=0\end{array}$$

$$f_{1D}(x,t)=\{\begin{array}{ll}{\delta }_{t,0}/x_m& x_b-x_m\le x<x_b\\ 0& \mathrm{elsewhere}\end{array}$$

$$F(t)=\frac{-\frac{d{R}_S(t)}{dt}}{-{\int }_0^{T}dt\frac{d{R}_S(t)}{dt}}=\frac{-\frac{d{R}_S(t)}{dt}}{R_S(0)-R_S(T)}$$

$$\begin{split}F(t)&=Z^{-1}\bigg{\{}u\bigg{[}\psi\Big{(}\frac{x_{m}-tu}{2\sqrt{Dt}}\Big{)}+\psi\left(\frac{u}{2}\sqrt{\frac{t}{D}}\right)\bigg{]}\\ +&\sqrt{\frac{4D}{\pi t}}\bigg{[}\exp{\left(-\frac{tu^{2}}{4D}\right)}-\exp{\left(-\frac{(x_{m}-tu)^{2}}{4Dt}\right)}\bigg{]}\bigg{\}},\end{split}$$

$$F(t)|_{u\to 0}=Z_{0}^{-1}\sqrt{\frac{D}{\pi tx_{m}^{2}}}\bigg{[}1-\exp{\left(-\frac{x_{m}^{2}}{4Dt}\right)}\bigg{]}$$

$$F(t){|}_{u\to 0;t\ll x_m}\sim t^{-1/2}.$$

$$\begin{split}P_{1D}(x,t)&=\frac{1}{2x_{m}}\bigg{\{}\psi\bigg{(}{\frac{x_{b}+ut-x}{\sqrt{4Dt}}}\bigg{)}+\psi\bigg{(}{\frac{x_{m}+x-x_{b}-ut}{\sqrt{4Dt}}}\bigg{)}\\ -&\exp{\bigg{[}\frac{-u(x_{b}-x)}{D}\bigg{]}}\bigg{[}\psi\bigg{(}{\frac{x_{b}+x_{m}-ut-x}{\sqrt{4Dt}}}\bigg{)}\\ +&\psi\bigg{(}{\frac{x+ut-x_{b}}{\sqrt{4Dt}}}\bigg{)}\bigg{]}\bigg{\}}\end{split}$$

$$\begin{split}R_{S}(t)&=\frac{1}{2x_{m}u}\bigg{\{}\left(D-x_{m}u+tu^{2}\right)\Psi\left(\frac{x_{m}-tu}{2\sqrt{Dt}}\right)\\ &-D\exp{\left(\frac{x_{m}u}{D}\right)}\Psi\left(\frac{x_{m}+tu}{2\sqrt{Dt}}\right)\\ &+2u\sqrt{\frac{Dt}{\pi}}\bigg{[}\exp{\left(-\frac{(x_{m}-tu)^{2}}{4Dt}\right)}-\exp{\left(-\frac{tu^{2}}{4D}\right)}\bigg{]}\\ &-\left(2D+tu^{2}\right)\psi\left(\frac{u}{2}\sqrt{\frac{t}{D}}\right)+2x_{m}u-tu^{2}\bigg{\}}\end{split}$$

$$\begin{split}Z=&\left(\frac{2D}{u}+Tu\right)\psi\left(\frac{1}{2}u\sqrt{\frac{T}{D}}\right)+\frac{D}{u}e^{\frac{x_{m}u}{D}}\Psi\left(\frac{x_{m}+Tu}{2\sqrt{DT}}\right)\\ &+\left(x_{m}-Tu-\frac{D}{u}\right)\Psi\left(\frac{x_{m}-Tu}{2\sqrt{DT}}\right)+Tu\\ &+2\sqrt{\frac{DT}{\pi}}\bigg{[}e^{-\frac{Tu^{2}}{4D}}-e^{-\frac{(x_{m}-Tu)^{2}}{4DT}}\bigg{]}\end{split}$$

$$Z_{0}=1+\sqrt{\frac{4DT}{\pi x_{m}^{2}}}\bigg{[}1-\exp\left(-\frac{x_{m}^{2}}{4DT}\right)\bigg{]}-\psi\left(\frac{x_{m}}{\sqrt{4DT}}\right)$$

Full text

Following the terror attacks in London, Manchester, Washington D.C. and Paris in 2017, and Orlando, Berlin, Nice and Brussels in 2016, authorities face the fundamental problem of detecting individuals who are currently developing intent in the form of strong support for some extremist entity – even if they never end up doing anything in the real world. The importance of online connectivity in developing intent 4 ; 5 ; 6 ; 7 ; 8 ; 3 ; 1 ; 9 has been confirmed by case-studies of already convicted terrorists by Gill and others 4 ; 5 ; 6 ; 7 ; 8 . Quantifying this online dynamical development can help move beyond static watch-list identifiers such as ethnic background or immigration status. Heuristically, one might imagine that an individual who enters an online space, wanders through the content available and – depending in part on what they find on any given day – feels pulled toward, or pushed away from, a particular extreme ideology. This process of individual fluctuation will be made even more complex by endogenous and exogenous factors in their own lives. Adding to the complication, humans are heterogeneous and hence may enter an online space at different times, spend different amounts of time online, and may end up losing interest and dropping out entirely, continuing in an uncertain state, or developing a high level of support.

We show here that despite this wide range of possible behaviors, a surprising level of universality arises in the online trajectories of individuals through an extremist space. We provide a stochastic walk model that connects together all individuals, even though they may end up with very different outcomes. Though our focus is on individuals’ online dynamics irrespective of whether they later carry out an extremist act or not, subsequent analysis of media reports together with others’ postings suggest that a significant number of individuals in our dataset do. Our dataset is assembled using the same methodology as Ref. scienceus , and includes the global population of $\sim 350$ million users of the social media outlet VKontakte (www.vk.com) which became the primary online social media source for ISIS propaganda and recruiting during 2015 scienceus . Unlike on Facebook where pro-ISIS activity is almost immediately blocked, support on VKontakte develops around online groups (i.e. self-organized communities) which are akin to Facebook groups that support everyday topics such as a sport team.

Given that other forms of extremism ranging from far-left to far-right also appear through such online groups (e.g. the Washington D.C. shooter DC and Maryland attacker Maryland were both members of such groups on Facebook), and given that many social media sites allow such community features (i.e. online groups), our results and model should have general applicability. Even the encrypted application Telegram allows users to set up ‘super-groups’ 9 . All these online groups tend to keep themselves open-source in order to attract new members, hence we were able to record the current membership of pro-ISIS groups at every instant using entirely open-source information. Each individual moving through such an online space can be classified at any time $t$ by what will happen to them in the future, even though he/she may at time $t$ still be undecided about supporting the ideology, or may even be moving away from it. Each individual at time $t$ has one of four unique labels:

Future banned: At some future time, he/she will develop and hence express such a high level of extremist support that their account will get banned by moderators. These individuals would likely be of most interest to authorities.

Future latent: At some future time, he/she will stop being a member of extremist groups but will not self-delete their account, perhaps reflecting indifference to the extremist ideology.

Future self-deleting: At some future time, he/she self-deletes their own account, perhaps because they are scared of being tracked.

Still ongoing: He/she will remain in development. Their account remains unbanned and they continue joining pro-ISIS groups (and possibly leaving, though group leaving events are rare).

We focus here on the first three individual types since they provide us with well-defined lifetimes and timelines in terms of the online extremist groups that they join. Banning and self-deleting events are announced on a user’s webpage by moderators when they occur. The clock-time lifetimes are $T_{\rm fut-ban}$, $T_{\rm fut-latent}$, and $T_{\rm fut-sdel}$: $T_{\rm fut-ban}$ is the time interval between them first joining a pro-ISIS group and their account being banned; $T_{\rm fut-latent}$ is the time interval between them first joining a pro-ISIS group and them ceasing to be a member of any pro-ISIS group; and $T_{\rm fut-sdel}$ is the time interval between them first joining a pro-ISIS group and them self-deleting their account. The event-time lifetimes $L_{\rm fut-ban}$, $L_{\rm fut-latent}$, and $L_{\rm fut-sdel}$, are given by the total number of groups that they join during the observation period. We model the instant of banning as an individual hitting an absorbing barrier for the first time at $b_{\rm abs}$ in a one-dimensional walk $b(t)$, where $b(t)$ represents the level of extremism (i.e. pro-ISIS support) that an individual expresses. The instant of becoming latent is when an individual hits an absorbing barrier $\ell_{\rm abs}$ during a one-dimensional walk $\ell(t)$, where $\ell(t)$ represents the desire to become latent. The instant of self-deletion is when an individual hits an absorbing barrier at $d_{\rm abs}$ in a one-dimensional walk $d(t)$, where $d(t)$ represents an individual’s desire to self-delete. Though an obvious over-simplification, such a single scalar parameter has already been adopted in other sociological contexts to mimic aspects of human personality axelrod ; Centola .

Each of the $\sim 350$ million VKontakte users undergoes their own walk in the three-dimensional $d$-$\ell$-$b$ space in Fig. 1, characterized by the position vector $(b(t),\ell(t),d(t))$ and with absorbing barriers at $d_{\rm abs},\ell_{\rm abs},b_{\rm abs}$ such that $d(t)<d_{\rm abs}$, $\ell(t)<\ell_{\rm abs}$ and $b(t)<b_{\rm abs}$. We identify 7,707 individuals that eventually hit the barrier along the $b$-axis in Fig. 1 (i.e. future banned individuals); 65,169 that eventually hit the barrier along the $\ell$-axis (i.e. future latent individuals); and 18,905 individuals that eventually hit the barrier along the $d$-axis (i.e. future self-deleting individuals). In principle, the components of the walks along each direction could be coupled, however for simplicity we treat each individual as executing a $1+1+1$-dimensional walk Stanley . Hence solving for the lifetime $T$ in a generic single dimension $x(t)$ with a single absorbing barrier at $x_{b}$ solves the problem for each of these dimensions and yields a lifetime distribution for the entire process. Allowing for non-zero drift velocity $u$ towards the respective barrier $x_{b}$, the Fokker-Planck equation for any component $x(t)$ in Fig. 1 becomes:

[TABLE]

where $x\leq x_{b}$, $0\leq t-t_{0}\leq T$. $T$ is the observation period and $D$ is the diffusion coefficient, assumed to be time-independent. For the simulations, we consider the discrete version with unit diffusion speed $\Delta x/\Delta t=1$, with $D=(1-u^{2})/2$ and $u=2p-1$ where $p$ is the probability of moving forward at each timestep. The solution is $G(x,t;x_{0},t_{0})=\Theta(t-t_{0})K(x,t;x_{0},t_{0})$, where the propagator $K(x,t;x_{0},t_{0})=\Phi(x-x^{\prime})-\exp{[{-u(x_{b}-x)}/{D}]}\Phi[x-(2x_{b}-x^{\prime})],$ $x^{\prime}=x_{0}+u(t-t_{0})$, and $\Phi(x)=\exp{[-{x^{2}}/{(4Dt)}]}/\sqrt{4\pi Dt}$. To mimic human heterogeneity, we consider a uniformly distributed initial condition at $t=t_{0}=0$:

[TABLE]

where $\delta$ is the Kronecker delta and $x_{m}$ is a normalization constant. $x_{m}=T\Delta x/{\Delta t}$ in the simulations. This is reasonable since individuals located below $x=x_{b}-x_{m}$ can never reach the boundary and hence can be ignored. The probability distribution $P_{1D}(x,t)=\sum_{t_{0}=0}^{T}\int_{x_{b}-x_{m}}^{x_{b}}dx_{0}K(x,t;x_{0},t_{0})f_{1D}(x_{0},t_{0}),$ and the total probability $R_{S}(t)=\int_{-\infty}^{x_{b}}dx{P_{1D}(x,t)}$ (see Supplemental Material (SM)). The distribution of clock-time lifetimes

[TABLE]

where

[TABLE]

where $Z$, and $Z_{0}$ below, are normalizations. When $u\to 0$:

[TABLE]

[TABLE]

Hence our theory predicts an approximate power-law distribution for clock-time lifetimes that are not too large, with a negative scaling exponent of magnitude $1/2$.

Figures 2(a),(c),(d) show that despite their very different origins and meanings, all three distributions tend to follow the same analytical $1/2$ power-law for intermediate clock-time lifetimes. Moreover this agreement can be improved by adding a small $u$ in Eq. (4) (e.g. Fig. 2(a)). A full numerical simulation of our model yields even better overall agreement (green curves). Deviations arise at short clock-time lifetimes for future-banned individuals (Figs. 2(a)(b)). However the good agreement can be restored if we add temporal correlations (TC, i.e. memory) to our walk model: with probability $q$, an individual changes his/her $x(t)$ value at time $t$ by adopting the same change that occurred $m$ timesteps earlier. Even the simplest case of $m=1$ shows good agreement (blue curves in Fig. 2).

Consistent with previous work suggesting that people are highly heterogenous in how long they take to do something barabasi , we find that the empirical event-time lifetime can be quite different from the corresponding clock-time lifetime. This motivates us to look at event-time. We represent the probability of an individual ending up in one of the three possible outcomes from Fig. 1, as an expansion (Fig. 3(a)) where each term is the probability that this happens (i.e. lifetime ends) after joining $n$ online groups 10 . Figure 3(b) shows the empirical value of these expansion terms (event-time lifetime is $n$): they follow an approximate power-law distribution with negative scaling exponent $\alpha\approx 2$. While we acknowledge that there are other possible explanations, this is consistent with the notion that someone joining $n$ groups accumulates $n$ potentially distinct narratives and hence may need to resolve $\sim n^{2}$ potential narrative discords, which in turn suggests that the attractiveness and hence probability of joining $n$ groups will decrease like $n^{-2}$. Figures 3(c)-(e) further unravel individuals’ timelines, conditional on the event-time lifetime from (b) and counting as $n$ the number of future-banned groups joined during the lifetime, i.e. $n$ in Figs. (c)-(e) only counts groups who will themselves get banned by moderators. These are of the most interest since by definition they will develop the most extreme content.

Just as for clock-time, Fig. 3(c)-(e) show that a stochastic walk model without time correlations (TC) provides poor agreement for short event-time lifetimes. Similar to before, we therefore introduce TC (i.e. memory): At each step, with probability $q$ the individual decides to join a group of the same type (i.e. either future-banned or not) as they did in one of their previous $m$ joining events, randomly chosen from $m$. Hence with probability $(1-q)p$, they join a future-banned group, and with probability $(1-q)(1-p)$ they join a non future-banned group. $m$ acts as a memory length, $q$ is the probability of making a decision according to this memory, and $p$ determines individual preference for a specific group type. The model simulation is over 10,000 individuals. $q$ is the dominant parameter in determining the model fit (see SM for details).

Figure 3(f) shows that $q$, and hence the impact of memory, is most prominent for short event-time lifetimes – consistent with the conclusion for clock-time lifetimes in Fig. 2. This has an important implication for authorities, since it means that among individuals who will eventually express the most extreme support and hence become banned (i.e. future banned individuals) the ones with shorter lifetimes will exhibit more temporal correlations and hence will exhibit more predictability in their trajectories: and it is precisely these rapidly-developing individuals who likely carry the highest risk of committing future acts.

Having characterized and quantified the trajectories of individuals, and established the increasing importance of temporal correlations at short lifetimes in both clock-time and event-time, we move to many-body correlations. Though a full theory generalizing the expansion in Fig. 3(a) awaits future development, Fig. 4 shows the surprising strength and complexity of correlations that evolve over time in the system. Specifically, it shows the average information quality ratio (IQR) 15 of the group joining events (and leaving events, though these are rare) for pairs of individuals of a given type, where ${\rm IQR}(X_{i};X_{j})=I(X_{i};X_{j})/H(X_{i},X_{j})$. Here $X_{i}$ and $X_{j}$ are two random variables, $I(X_{i};X_{j})$ is the mutual information of the two random variables, and $H(X_{i},X_{j})$ is their joint entropy. In our case, $X_{i}$ and $X_{j}$ represent the behaviors of individuals $i$ and $j$ on a given day; therefore IQR becomes an effective measure of the particle-particle correlations. For our dataset, the joint probability density function $P_{X_{i},X_{j}}(x_{i},x_{j})$ is the probability that two individuals’ behavior on any given day is $(x_{i},x_{j})$, where $x_{i}$ is measured as the sign of the net change of the number of groups $i$, and therefore $x_{i}\in\{-1,0,1\}$ (see SM).

Figure 4 shows that the correlations between trajectories from different sub-populations (Fig. 4(a)) and within the same sub-population (Fig. 4(b)) are all stronger than expected from a null model in which the order of the list $\boldsymbol{x}_{i}$ (and $\boldsymbol{x}_{j}$) is randomized at a given timestep. This highlights the need to develop an interacting propagator picture for the three individual types. The many-body correlations between future banned users (b–b in Fig. 4(b)) are typically the strongest during the entire period, suggesting that individuals who will go on to develop the most extreme forms of support are the most synchronized. This suggests a new dynamical collective phenomenon by which a relatively small subset of individuals manages to develop coordination within a much larger reservoir of individuals. By contrast, the correlations between future self-deleting individuals are nearly non-existent, suggesting that the movement toward deciding to self-delete is a personal one.

In summary, we have identified, unraveled and quantified the trajectories of individuals wandering through an online extremist space, and found that surprising statistical universalities exist despite the heterogeneity in individuals’ behaviors and their final outcomes. Our findings establish the increasing importance of temporal correlations at short lifetimes in both clock-time and event-time, which has practical implications for authorities wishing to identify potential high-risk individuals. Our data and results may also help open the path toward a ‘many-body’ theory of human behavior 11 ; 12 ; 13 ; 14 in which single-particle propagators (individuals) successively scatter through dynamical groups that themselves comprise other single-particle propagators, thereby yielding a coupled hierarchy of propagators in a fuller diagrammatic expansion 10 .

Acknowledgments We thank A. Gabriel, A. Kuz, J. Nearing and T. Curtright for initial help with data and discussions. NFJ acknowledges funding under National Science Foundation (NSF) grant CNS1522693 and Air Force (AFOSR) grant FA9550-16-1-0247. The views and conclusions contained herein are solely those of the authors and do not represent official policies or endorsements by any of the entities named in this paper.

Supplemental Material (SM)

A: Details in the derivation of the clock-time lifespan distribution

The explicit form of $P_{1D}(x,t)$:

[TABLE]

where $\psi(x)$ is the error function.

The explicit form of $R_{S}(t)$:

[TABLE]

where $\Psi(x)$ is the complementary error function.

The explicit form of $Z$:

[TABLE]

The explicit form of $Z_{0}$:

[TABLE]

.

B: Details of Figs. 3(c)-(f)

Stochastic simulations show that increasing $m$ would strengthen the memory effect significantly only when $q$ is sufficiently large (e.g., above $\sim 0.7$). Hence for most values of $q$, the profile of the distribution $P_{o\rightarrow b}(n\textrm{B}|L_{ban})$ is primarily determined by $q$. Hence we let $m=1$ for simplicity, and estimate $q$ and $p$ for each value of $L_{ban}$ from the empirical data using maximum likelihood estimation (MLE), and perform a model fit to the empirical results by simulation. For the memory model with $m=1$, the likelihood for an individual $i$ to have a path $\mathbb{S}_{i}=\{S_{i}[t]|S_{i}[t]\in\{0,1\},t=0,1,2,...,L-1\}$ ($S_{i}[t]=0$ corresponds to joining a future-banned group, and $S_{i}[t]=1$ corresponds to joining a non future-banned group) is given by $\mathcal{L}_{i}=\prod_{t=0}^{L-2}\{p+q-S_{i}[t+1]q+2S_{i}[t+1]S_{i}[t]q-pq+S_{i}[t](1-2p-2q+2pq)$ Therefore, $p$ and $q$ are given by $\operatorname*{arg\,max}_{(q,p)}\bar{\mathcal{L}}\equiv\frac{1}{N}\sum_{i=1}^{N}\mathcal{L}_{i}:=\{(q,\ p)|0\leq q,\ p\leq 1\}$. When doing the simulation for a given $L_{ban}$, we do a separate stochastic simulation of 10,000 individuals; and since there is no history in the first step, we randomly assign the initial memory for each individual (the same for other two types of individuals).

C: Details of $\langle{\rm IQR}\rangle$

Without loss of generality, we here show the calculation of the average IQR (i.e. $\langle{\rm IQR}\rangle$) between the future banned and the future self-deleting users (denoted as b—d) in Fig. 4(a). First, we pick an individual $i$ from the sub-population of future banned individuals, and an individual $j$ from the sub-population of future self-deleting individuals, and we perform the statistics to obtain $P_{X_{i}}(x_{i})$, $P_{X_{j}}(x_{j})$, as well as $P_{X_{i},X_{j}}(x_{i},x_{j})$ (see the main text for the definitions). For the values of day $t$, the statistics are done from the $(t-10)$’th day to the $(t+10)$’th day (i.e. a moving window of size 20 days). In order to reduce noise we smoothened the curve by averaging over every 10 days. Therefore for individual $i$, the values of $x_{i}$ form a temporally ordered list $\boldsymbol{x}_{i}$. Hence, the mutual information is given by I(X_{i};X_{j})=\sum_{x_{i},x_{j}}P_{X_{i},X_{j}}(x_{i},x_{j})\log_{2}\bigg{[}\frac{P_{X_{i},X_{j}}(x_{i},x_{j})}{P_{X_{i}}(x_{i})P_{X_{j}}(x_{j})}\bigg{]}, the joint entropy is given by $H(X_{i};X_{j})=-\sum_{x_{i},x_{j}}P_{X_{i},X_{j}}(x_{i},x_{j})\log_{2}[P_{X_{i},X_{j}}(x_{i},x_{j})],$ and therefore, the IQR is given by $IQR(X_{i};X_{j})=I(X_{i};X_{j})/H(X_{i};X_{j}).$ We ignored user pairs whose joint entropy is zero since they represent mostly trivial cases in which no joining/leaving events occurred. Finally, we average over all combinations of the user pairs to obtain the average IQR. Since our dataset is so large, we sampled 2000 users for each individual type 10 times in order to obtain the mean values and their standard deviations.