Research Projects
National Security Research
Under the Radar: Analyzing Recent Twitter Information Operations to Improve Detection and Removal of Malicious Actors, Part 2
This report builds upon the work done in part one of this series by examining the network structure of three information operations (IOs) that were removed from Twitter in 2021. The analysis that follows uses social network analysis (SNA) to explore the structure, key network statistics, and measures of centrality for network graphs created from Twitter mentions. This project seeks to determine if it is possible to make cross-network comparisons that could enhance the early detection of IOs on social media platforms like Twitter. The analysis found that while each network was structurally unique, the key SNA statistics failed statistical significance testing when checking for differences between the IO group and control group. This may be the result of a small network sample size (n=5). However, this study also found that measures of centrality had statistically significant differences between the IO group and the control group. This suggests that measures of centrality, particularly eigenvector centrality and Pagerank, could be useful metrics for differentiating IOs from legitimate Twitter conversations.
Under the Radar: Analyzing Recent Twitter Information Operations to Improve Detection and Removal of Malicious Actors, Part 1
This report analyzes some of the key similarities and differences across three tweet datasets collected from recent IOs in the hope of shedding some light on the possible reach and return on investment gained by malign actors conducting these IOs. Each of the three Twitter datasets focus on a separate country, Russia, China, and Iran, all disrupted by Twitter in 2021. This analysis found that Iran’s IO had the widest reach. This was contrary to, or perhaps because of, the growing attention placed on Russian IOs and, to a lesser extent, Chinese IOs. This analysis also revealed that more accounts do not necessarily yield a greater overall reach for the IO and that a more generalized response mechanism for countering IOs, regardless of country of origin, remains imperative. Lastly, these datasets lend themselves well to further analysis, which I am hopeful will prompt a series of follow-on reports aimed at improving detection and disruption of these operations.
Blind Sided: A Reconceptualization of the Role of Emerging Technologies in Shaping Information Operations in the Gray Zone
By Ashley Mattheis, Daveed Gartenstein-Ross, Varsha Koduvayur, and Cody Wilson
This report contributes to the study of grey zone information operations in some really unique ways. For starters, we introduce a new framework to describe how information operations influence information environments. Next, we apply elements of evolutionary theory to describe why some info op tactics, techniques, and procedures (TTPs) are mimicked and replicated while other TTPs die off. Lastly, due to this evolutionary nature, we reframe the analysis of info ops to focus on TTPs and how they may be adapted by various actors in the future, as opposed to anchoring on what a particular threat actor is doing today. With this report, we hope to create a playbook of different TTPs that security professionals can use to anticipate and counter threats from various actors that may seek to influence a particular information environment. By focusing on the TTPs themselves, it is our hope that future analysts will not be blind sided by emerging threats while focusing on the previous threat.
Redrawing the Lines: An Assessment of the Impact of “Anti-Censorship” Legislation on Terrorist Content, Hate Speech/Harassment, and Mis/Disinformation
By Daveed Gartenstein-Ross, Madison Urban, and Cody Wilson
The report digs into some of the loopholes and potential unintended consequences of the “anti-censorship” laws that passed in Florida and Texas in 2021, both of which are currently (as of October 2022) mired in legal challenges and controversy. Content moderation on social media platforms has become an increasingly contentious topic in recent years, paving the way for sweeping, and often vague, calls for “anti-censorship” legislation like those seen in Texas and Florida. While there are certainly legitimate concerns about the extent of content moderation, the Texas and Florida laws are rife with issues and go about addressing these concerns in problematic ways. In the article, we highlight some of the ways in which Texas and Florida’s sweeping “anti-censorship” laws, and ones similar to them that other states are trying to pass, could create more harm than good.
This report was also adapted into an article for Lawfare, which can be found here.
Inciting Violence: The Impact of Internet Propaganda on Terrorist Outcomes
Many studies have examined ISIS’ usage of Twitter and other Internet platforms to cultivate their “online caliphate.” Despite all of this attention on the online sphere, relatively few studies have examined how online propaganda influences real-world behavior. Of those studies that exist, few are on a generalizable scale. The following aims to provide early findings of the relationship between the broader Global Jihadist Movement’s online and offline activity, particularly regarding membership and real-world violence. This mixed-methods study collected data on online activity, membership, and group-perpetrated violence for almost seventy groups for the period of 1998 to 2018. Online activity was compared separately to membership and group-perpetrated violence. Then, multiple regression models quantified the overall impact on real-world events. The results suggest online activity exerts a moderately strong, statistically significant effect on violence and a moderate effect on membership. A correlation appeared to be present between all three variables, which suggests a reinforcing cycle of attacks producing online propaganda, online propaganda producing new members, and new members carrying out yet more attacks. This may be the driver of the upward trend found in all three data sets.
Missing the Mark: The Misalignment between Policy Responses and the Drivers of Conflict in Somalia
Somalia is a country locked in a complex conflict which has dragged on for almost three decades, displacing millions and leaving hundreds of thousands dead. The causes of the conflict are numerous and interrelated. This makes resolving the conflict that much more complicated. The situation is made worse by policies aimed at addressing the conflict which are often unclear, uncoordinated, or contradictory. This misalignment between drivers and approaches has left the country trapped in a state of perpetual chaos. What follows is an examination of some of the major historical events that led to the modern day conflict in Somalia, analysis of the major policy responses, identification of where these responses have missed the mark, and a series of lessons that should be learned going forward. This case study aims to examine Somalia’s seemingly perpetual conflict with a focus toward both informing policymakers and highlighting a need to more critically evaluate policy goals and objectives in Somalia to ensure policies are actually addressing the problems they are intended to address. This paper also appeared on Talking About Terrorism, which you can check out here.
The Role of Female Recruits in the Islamic State of Iraq and Syria
The so-called caliphate that was created by the Islamic State attracted female recruits at a level not previously seen by other Salafi-Jihadist groups. This new phenomenon led to the creation of many unfounded assumptions about the role of female jihadists; however, subsequent theoretical research has emerged in recent years that challenges many of these assumptions and provides valuable insight into why this phenomenon may have actually taken place. What follows is an analysis of some of this valuable research as well as an application of these theoretical concepts to the real world through an examination of female jihadists who joined the Islamic State. This study profiles several women who joined the Islamic State and their reasons for joining, and it is aimed at better understanding, through the lens of the theories examined, why these women and others like them willingly chose to travel to the caliphate to become jihadists.
Mapping Conflict in MENA: A First Adventure into GIS Software
In 2019, I compiled conflict data for the Middle East and North Africa from 2016-2019 from the Armed Conflict Location & Event Data (ACLED) Project into a single data set that I ran through QGIS to map the conflict hot spots. I color coded incidents based on conflict intensity and set the size of each data point based on the number of casualties from the incident. In total, the Middle East data set contained over 136,000 events, and the cleaned data set for North Africa contained another roughly 12,000 events. This example shows the power of being able to visualize large datasets both in general and as it pertains to the study of conflict. In spreadsheet or data frame form, such a large number of events is overwhelming and doesn’t give the analyst a sense for patterns or scale. Fortunately, free and open source tools like QGIS are available to enable experts and novices alike to begin to better understand their data. This example demonstrates what a first-time user can do in just a couple of hours, but even more advanced methods can open up whole new avenues of study. Hearing about projects like Uppsala University’s Violence Early-Warning System (ViEWS), for example, which applies mathematical models and artificial intelligence to conflict data to predict which locations are at the highest risk for future violence makes me excited to see what new and emerging technologies can offer to help us better understand and prevent violent conflict.
Machine Learning as a Driver of Change for Cyber Operations
Machine learning is a powerful tool that has the potential to dramatically reshape how cyber operations are conducted. Like any tool, AI can be used to positive or negative effect. This means both offensive and defensive cyber operations will be changed by widespread deployment of machine learning algorithms by legitimate as well as malicious actors. Machine learning will allow for greater attack sophistication and automation both for offensive cyber operators and malicious actors. Conversely, machine learning will allow for improved attack detection and automated response, increasing challenges for offensive cyber operations while enhancing defensive capabilities. Machine learning tools may bring their own set of new vulnerabilities and other unintended consequences.
International Institutions: An Underutilized Tool for Combating the Financing of Terrorism
During the 1980s, the pace of globalization increased dramatically. The world shrunk in size as companies opened up factories in other countries, new trade agreements went into effect, and global prosperity for all was promised. The world continued shrinking in the 1990s when the Internet sped up the forces of globalization even more. However, globalization also mobilized backlash in the form of radical fundamentalist groups like Al-Qaeda. Over the last thirty years, Al-Qaeda globalized as well. It now has affiliates in dozens of countries, and it has used the infrastructure built by the forces of globalization to create a worldwide financing network. This network takes advantage of the international banking system, informal remittances, donations, and more. Since the 9/11 attacks, national governments and their regional partners have tried to combat the financing of terrorism, but Al-Qaeda has simply altered its financing strategy to circumvent these measures. The limited cooperation at the international level has allowed Al-Qaeda to continue raising millions of dollars per year, and emerging technologies have gotten Al-Qaeda’s attention as a further source of funding, planning, and communication. These globally connected technologies now threaten to allow Al-Qaeda and others to “go dark” while expanding their financial resources as national and regional governments try to play catch up. Analysis of Al-Qaeda’s financing network highlights why national and regional approaches to combating the financing of terrorism are inadequate and must be done in conjunction with international institutions.
Why the “Military Option” With North Korea Sucks
In 2017, when I was applying to graduate school, I had the opportunity to write a piece for a former colleague who was starting a new website, Inkstick Media. At the time, tensions on the Korean Peninsula were rising as talk of a “military option” to deal with North Korea was casually being thrown around in the U.S. Yet the details of what the military option might entail were scant. Worse, many seemed to be forgetting about the potential risks involved with even a small scale conflict involving a heavily armed foe that had weapons trained on a close ally. The chance to write for Inkstick was the perfect opportunity to delve into the “military option” and why it, well, sucked as a viable policy option. Read the full article and check out more of what Inkstick has to offer here: