Abstract:Support for extremist entities -whether from the far right, or far left --often manages to survive globally online despite significant external pressure, and may ultimately inspire violent acts by individuals having no obvious prior history of extremism. Examining longitudinal records of extremist online activity, we uncovered an ecology evolving on a daily timescale that drives online support, and we provide a mathematical theory that describes it. The ecology features self-organized aggregates (online groups such as on Facebook or another social media analog) that proliferate preceding the onset of recent real-world campaigns, and adopt novel adaptive mechanisms to enhance their survival. One of the predictions is that development of large, potentially potent online groups can be thwarted by targeting smaller ones.2 Extremist entities such as ISIS (known as Islamic State) stand to benefit from the global reach and speed of the Internet for propaganda and recruiting purposes, in ways that were unthinkable for their predecessors (1)(2)(3)(4)(5)(6)(7)(8)(9)(10). This increased connectivity may not only facilitate the formation of realworld organized groups that subsequently carry out violent attacks (e.g. the ISIS-directed attacks in Paris, November 2015) but may also inspire self-radicalized actors with no known prior history of extremism or links to extremist leadership, to operate without actually belonging to a group (e.g. the ISIS-inspired attack in San Bernardino, December 2015) (11). Recent research has used records of attacks to help elucidate group structure in past organizations for which the Internet was not a key component (3,6,12), the nature of attacks by lone-wolf actors (13) and the relationship between general online buzz and real-world events (14-16). Online buzz created by individuals that casually mention ISIS or protests is insufficient to identify any long-term build up ahead of sudden real-world events (see for example Fig. S1). This leaves open the question of how support for an entity like ISIS develops online prior to any real-world group necessarily being formed, or any real-world attack perpetrated --whether by 'recruits' or those simply 'inspired'.Our datasets consist of detailed second-by-second longitudinal records of online support activity for ISIS from its 2014 development onwards and, for comparison, online civil protestors across multiple countries within the past three years following the U.S. Open Source Indicator (OSI) project (14-16). The online Supplementary Material (SM) provides a roadmap for the paper, data descriptions and downloads. The data shows that operational pro-ISIS and protest narratives develop through selforganized online aggregates, each of which is an ad hoc group of followers of an online page created through Facebook or its global equivalents such as ВКонтакте (VKontakte) at www.vk.com (Fig. 1). These generic web-based interfaces allow such aggregates to form in a language-agnostic way, and with freely chosen names that help attract followers wi...