Several co-authors of this paper participated in a recent IARPA project to help build a reliable database of civil unrest events across countries in Latin America.

The rationale here is that if anti-ISIS agencies do not shut down smaller aggregates at a sufficient rate, these aggregates will merge (coalesce) into bigger ones, which will be harder to shut down. Eventually, this process will repeat until a "super-aggregate" is formed, which will be very hard to shut down.

In statistics, the term robust or robustness refers to the strength of a statistical model, indicating that the model has good performance for data drawn from a wide range of probability distributions.

A power law is a functional relationship between two quantities, where one quantity varies as a power of the other.

An example of a power law is Zipf's Law, which says that the distribution of words in a given corpus of text is a function of the frequency of the words. In a given corpus of text, the most frequent word occurs twice as much as the second most frequent one, which shows up twice as much as the third most frequent one, and so on.

A stochastic event has a random probability distribution or pattern that may be analyzed statistically but may not be predicted precisely.

An aggregate shutdown is a stochastic event because it depends on the probability of that aggregate being found by predators (entities capable of shutting it down).

An aggregate is fragmented when it is broken down into other aggregates of smaller size. This happens, for instance, when an aggregate is shut down.

The curve mentioned here is the progress curve analysis of organizational development. Using the formula for this curve, the time interval between the creation of the n-th and (n + 1)-th aggregate is given by:

$$\tau_n = \tau_1 n^{-b}$$

If b is zero in the formula above, then the creation of aggregates would depend only on the previous number of aggregates. However, in the authors' experiments, b is different from zero, which indicates that there is some perturbation (escalations and de-escalations) to the process of aggregates creation.

A bipartite graph is a set of graph vertices decomposed into two disjoint sets such that no two graph vertices within the same set are connected.

In the paper, the disjoint sets of nodes that constitute the bipartite graph are aggregates and followers. In this graph, there are no direct connections between aggregates (they can only be connected through other people). The same holds for followers: they are connected to aggregates, but not (directly) to other followers.

As from the Supplementary Material, the manual analysis described here can be broken down into the following steps:

• Experts search websites such as VK.com for common hashtags and keywords on a daily basis.
• A manual list of aggregates, which was updated daily, was assembled by the experts to include only those aggregates appearing to express a strong allegiance to ISIS.
• To find newly created aggregates, the experts analyze posts and reposts among known aggregates, as well as follow selected profiles that actively publish ISIS news.
• Newly found aggregates were included in the authors' database.
• The database of aggregates was analyzed on a daily basis to determine which aggregates were still active and which were shut down.

An account page created on Facebook or VKontakte can be marked as an "organization". These pages are often used for informal organizations or groups of people interested in a particular subject. In the case of pro-ISIS aggregates, the pages contain material expressing a strong allegiance to ISIS and are followed by people interested in such material.

In the Supplementary Material, the authors point out that pages containing ISIS-related content are almost imediately shut down on Facebook and that such pages experience longer lifetimes on VKontakte.

A terrorist attack consisting of a mass shooting and an attempted bombing at the Inland Regional Center in San Bernardino, California, in which 14 people were killed and 22 others were seriously injured.

Read more on The New York Times.

Self-radicalization is a phenomenon by which individuals become terrorists without affiliating with a radical group, although they may be influenced by its ideology and message.

Reference: http://en.citizendium.org/wiki/Self-radicalization

A series of coordinated terrorist attacks that occurred on Friday, November 13, 2015, in Paris, France. In the first attack, three suicide bombings occurred outside a football match. The second consisted of several mass shootings and a suicide bombing at several cafés and restaurants. The third was a mass shooting at a concert.

Read more on The New York Times.

An ad hoc group of followers of an online page that interact in a language-agnostic way and with freely chosen names that help attract followers without making public the identities of the group's members.

The paper uses the term aggreagates in three ways:

1. as a members of an ad hoc group of followers on an online page (as defined above);
2. as refering to pro-ISIS aggregates, which are aggregates that appear to express a strong allegiance to ISIS;
3. in contrast to followers, which are people who interact with aggregates online.

In the Supplementary Material, the authors provide a link to a video showing how agrregates can be set up for any purpose on Facebook, VKontakte, and other similar websites.

The term "ecology" can be defined as the set of relationships between a complex system and its surroundings or environment. In the context of this paper, the relationship between pro-ISIS ad hoc groups formed online constitutes an ecology. It can also be interpreted as "ecosystem" in this context.

A process that is repeated several times until a desired outcome is reached.

The authors propose a way of predicting the final number of reshares of a given post on social networks.

The authors propose a tool, called Perseus, that makes it easy for the user to analyze large graphs by supporting the coupled summarization of graph properties and structures, guiding attention to outliers, and allowing the user to interactively explore normal and anomalous node behaviors.

This result may seem counter-intuitive, but it makes sense when we consider the costs of shutting down larger aggregates versus the costs of shutting down smaller ones. It is easier to shut down smaller aggregates.

The extent to which observed data match the values expected by theory.

In this context, the value P = 0.86 says that 86% of the values observed matched those predicted by the proposed model.

This process happens when an unattached follower is combined to an aggregate, or when an aggregate is absorbed into another.

The shapes resembling parts of a shark's body. These shapes are shown in the chart by an increase followed by an abrupt drop.

A phase transition is an abrupt, discontinuous change in the properties of a system. It happens, for instance, when a liquid turns into a gas. The equation describing such transition is the one shown here in the paper:

$$(T_c - t)^{-1}$$

In the context of the paper, the authors model the onset of an event as a phase transition using the formula above. They also argue that this formula can be used to predict the future time for an onset of a real-world outburst.

The goal of (14,15) was to help build a "Gold Standard Report" (GSR) reliable database of civil unrest events across countries in Latin America.

Links that appear within a given post.

An Application Programming Interface (API) is a set of clearly defined methods of communication between various software components.

Drone strikes have been used to combat ISIS fighters.

Read more on Newsweek.

A community of interacting agents and their environment. In the context of this paper, the ecosystem has interacting agents (aggregates and followers), an environment (the Internet), and even predatory entities (police cybergroups, individual hackers, and website moderators).

On a daily basis, experts looked for specific hashtags and keywords that indicated activities related to ISIS or to civil unrest. Then, at the same time each day, these experts logged into VK.com--an equivalent of Facebook that is popular in Europe--and searched for newly created aggregates, which were then inserted into a database.

Records of the same variables, which in the case of this paper are hashtags that may suggest ISIS-related activity, observed over a given period of time.