Contemplating the Future of Social Media, Dark Networks, and Counterinsurgency 1

By: Sean Everton

The spectacular growth in social media over the last decade, led by Facebook, YouTube, and Twitter, and their potential usefulness have not been lost on insurgents and others using what we call dark networks.3 Over the last few years, such groups have increasingly turned to social media to communicate with and motivate their followers and supporters. For example, the use of social media by Egyptian insurgents during the Arab Spring is well documented,4 and other dark networks, such as the FARC (Fuerzas Armadas Revolucionarias de Colombia—Revolutionary Armed Forces of Colombia) and the Free Syrian Army (FSA), have attempted to exploit their functionality as well. At the same time, authorities have been seeking ways to capture the information that dark networks share through social media. To date their efforts have yielded minimal returns, but there is good reason to believe that this could change in the future.

"We use Facebook to schedule the protests, Twitter to coordinate, and YouTube to tell the world." — Cairo activist, Egyptian Arab Spring2

Speculating about the future is almost always a tenuous endeavor, and contemplating the interplay of social media, dark networks, and counterinsurgents is no exception. I'll limit myself here to discussing three of many possible scenarios: the use of social media by insurgents to communicate and disseminate information; social media's value for authorities who track and disrupt dark networks; and the ways both insurgents and authorities use social media to frame and reframe discontent.

Communication and Diffusion

Scholars have long highlighted the importance that communication networks play in the mobilization of insurgencies and other social movements. "For example, the communication channels that were long embedded in African American churches and historically black colleges were employed to help coordinate communications in the black civil rights movement of the 1950s and ‘60s;" more recently scholars have noted that the internet, satellite broadcasting, and cell phone technologies "have helped to mobilize and sustain various uprisings, protests, and insurgencies since the 1990s."5 Thus, it is not surprising that contemporary insurgencies, such as the FARC and the FSA, have turned to social media to help mobilize members and supporters. The FARC and some individual members have their own websites, while the group's commander, Timoleon Jimenez, a relative newcomer to the world of social media, recently issued a series of tweets attacking the Colombian government, less than two weeks before peace talks were to begin.6 Similarly,the FSA operates two Facebook accounts on which it posts information concerning its military operations; it also uses Twitter and YouTube to communicate with and disseminate videos to its followers.7

Authorities have been seeking ways to capture the information that dark networks share through social media.

How insurgents and other groups use these media in the future will hinge, of course, on how social media evolve. It is a reasonable assumption that the platforms will only get faster, easier, and less expensive, making them even more attractive to insurgents. We can also be reasonably confident that insurgencies and other dark networks will attempt to remain on or close to the technological cutting edge.

Contemporary insurgencies such as the FARC and the FSA have turned to social media to help mobilize members and supporters.

That said, given how easy it is to track the posts, tweets, and video uploads of insurgent groups, it is surprising that they are so open about what they are doing and with whom they communicate. Moreover, one would expect that counterinsurgents would attempt to use such information to their advantage. For example, it seems logical that the Assad regime would regularly monitor the FSA's online activity, since the information contained therein might offer them a strategic advantage in their efforts to better counter the FSA's operations. It appears, however, that either the regime is unaware of the FSA's use of social media, or it lacks the technological sophistication needed for monitoring the FSA's activities in a timely manner. What this suggests is that until counterinsurgents develop the tools necessary to track how insurgents use social media, dark networks will continue to have the advantage.

Insurgencies and other dark networks will attempt to remain on or close to the technological cutting edge.

Tracking and Disrupting

That the Assad regime appears unable to track the FSA's on-line activities does not mean that others cannot or are not doing so, however. For example, the New York Police Department (NYPD) became aware that newer gangs are using social media to boast of their exploits and taunt rival gangs, and therefore have been able to monitor the gangs' activities. "By capitalizing on the irresistible urge of these suspects to brag about their murderous exploits on Facebook, detectives used social media to draw a virtual map of their criminal activity over the last three years."8 In fact, by monitoring the conversations and trash talk between two rival gangs on Facebook, the NYPD was able to arrest 49 gang members on homicide and other criminal charges.9

What this suggests is that by tracking social media posts and uploads, not only can authorities be alerted to significant events and uncover selfidentified perpetrators, but they can also identify key members through the use of analytical methods such as social network analysis.10 For example, as my colleagues and I discuss in our article "Mining Twitter Data from the Arab Spring" (in this issue), network data culled from publicly available micro-blogging tools such as Twitter can help analysts and operators identify individuals worth tracking, and ideally improve knowledge of the network. This kind of knowledge is essential to improve the crafting of disruption strategies over time:

In the successful strikes against al Qaeda affiliates in Singapore, Morocco, and Saharan Africa, the key doctrinal approach was to wait and watch for a considerable period, then to swarm the targets simultaneously at their moment of maximum illumination. This strategic patience grew out of the understanding that striking at nodes as they were identified might actually reduce the ability to detect and track other cells in the networks in question. It is a curious fact [that]… the more that is disrupted, the less may be known.11

Using social media to track and ultimately disrupt dark networks will, of course, turn on the ability to scrape social media data in near real-time. While techniques for doing so are in their infancy, analysts, for example, recently developed a program (NodeXL) designed for pulling network data from social media sites such as Facebook, Twitter, Wikipedia, YouTube, and so on.12 More recently, Russell Shepherd and Patrick Dudas helped the Defense Analysis Department's CORE Lab at the Naval Postgraduate School create a tool for gathering publicly available Twitter posts in near real-time. The Lab recently used this tool to track the social media use of the FARC, the FSA, the Taliban, the Omari Battalion, and others dark networks, as well as anti-regime protesters in Egypt.

It is hard to imagine that insurgencies and other clandestine actors would continue to use social media if counterinsurgent analysts become increasingly adept at tracking their movements and mapping their interactions. We can be sure, however, that the social media market will continue to evolve, and that current major players such as Facebook, Twitter, and YouTube may give way in turn to new sites that are easier and more convenient to use. It is also highly likely that insurgencies will turn to these newer media as counterinsurgents get a handle on older ones. Thus, it is possible to imagine a scenario where insurgents, or at least the successful ones, will stay one step ahead in the exploitation of social media functionality.

Framing and Reframing

Scholars have noted that discontent by itself does not produce insurgencies. To take action, people must believe that change is not only necessary but also possible. They need to be able to perceive, interpret, and explain a situation in such a way that compels them to mobilize.13 This is most effectively accomplished by budding insurgencies when they frame their core message in ideological snippets that resonate with their target audience.14 As we describe in our article on Egypt's Arab Spring, it is easy to see the potential role that tools such as Twitter, with its 140-character limit on tweets, can play in the framing of grievances by insurgencies. A report published by the Project on Information Technology and Political Islam at the University of Washington concluded that social media played a role in framing the Arab Spring in three major ways: by shaping political debates, by spreading democratic ideas, and by facilitating online "revolutionary conversations" that often preceded major events on the ground.15

It is easy to see the potential role that Twitter can play in the framing of grievances.

What has received less attention is the ways in which authorities can use social media to reframe discontent so that it is redirected in more benign directions. An example of the potential for reframing was recently illustrated by a Twitter conversation in response to a Newsweek cover that featured two men with fists in the air under the headline, "Muslim Rage."16 In an effort to promote a conversation about the cover story, which concerned riots that broke out in response to a film clip posted to YouTube lampooning Islam, Newsweek asked its readers to tweet their thoughts. What it got in response was an onslaught of comments that mocked both the Newsweek story and the Islamic rioters in the Middle East. One reader captured the general sentiment:

I think it was this unspoken communal desire to reclaim the initiative, not just from what was regarded as kind of a cynical and inflammatory cover from Newsweek, but also just from a terrible, terrible week. I mean, it had been a really disillusioning week, seeing the way that this movie was responded to in Muslim countries in the Middle East. Even if it was only a thousand people here and a thousand people there, seeing people take the bait so easily was depressing … I think for a lot of people it sort of restored their faith in the community, because, honestly, this should have been the response to this movie from the very start. It should have been mocked and then ignored (emphasis added).17 The dampening effect, if any, that these tweets may have had on the riots in the Middle East is difficult to determine, but they illustrate the potential of how social media tools, such as Twitter, can be harnessed to reframe discontent, so that rather than resorting to violence, people can express their anger in public dialogue.18

Not only can social media be used to reframe discontent, however, they can be used to turn public opinion against popular insurgent movements as well. For example, Óscar Morales, a Colombian civil engineer, grew increasingly frustrated by the FARC's human-rights abuses, so in 2008 he set up a Facebook page called "One Million Voices Against the FARC," whose motto was "No more kidnappings, No more lies, No more killings, No more FARC."19 His campaign not only helped attract attention to the insurgents' indiscriminate use of violence, but it led to worldwide protests against the FARC.20 Some analysts are beginning to imagine how social media can be used to alienate insurgent groups and other dark networks from the wider population, a key aspect of counterinsurgency theory.21

Whither the Future?

So what can we say about how insurgents and authorities will attempt to capitalize on social media tools to further their goals? I think it is relatively safe to conclude that insurgents will continue to turn to social media to communicate and frame grievances, and if the past is any indication of the future, they will become increasingly sophisticated in doing so. This will place a heavy burden on those of us who seek to disrupt dark networks, to keep abreast of the latest social media developments. It is fairly certain that as we become more adept at tracking the movements of insurgents, terrorists, criminals, and others from information gleaned from social media outlets, these actors will abandon old technologies in favor of new ones. The rewards for attaining and maintaining a high level of technological sophistication in the use of social media are high. The costs for not doing so may be even higher.

As we become more adept at tracking insurgents, terrorists, and criminals, these actors will abandon old technologies in favor of new ones.

About the Author(s): Sean Everton is an assistant professor in the DA Dept. and the co-Director of the NPS CORE Lab. Prior to joining NPS in 2007 he was an adjunct professor at both Santa Clara University and Stanford University. Professor Everton earned his M.A. and Ph.D. in Sociology at Stanford University (2007). He has published articles in the areas of social network analysis, sociology of religion, economic sociology, and political sociology. He recently published a monograph for Cambridge University Press on using social network analysis for the crafting of strategies for the disruption of dark (i.e., criminal and terrorist) networks.


1. I'd like to thank my colleagues Rob Schroeder and Seth Lucente for their cogent comments and suggestions for improving this article.

2. Quoted in Nadine Kassem Chebib and Rabia Miatullah Sohail, "The Reason Social Media Contributed to the 2011 Egyptian Revolution," International Journal of Business Research and Management 2 (2011): 139.

3. Dark networks are those groups that actively seek to hide their activity from existing authorities. They are typically defined as "covert and illegal" networks and are often assumed to be malicious. See Jörg Raab and H. Brinton Milward, "Dark Networks as Problems," Journal of Public Administration Research and Theory 13 (2003): 413–39. They can, however, be forces for good, such as the World War II Polish resistance group Żegota illustrates (see Irene Tomaszewski, and Tecia Webowski, Żegota, The Council for Aid to Jews in Occupied Poland, 1942-45, rev. ed. (Montreal: Price-Patterson, Ltd., 1999), or, as some may argue, in several countries during the Arab Spring uprisings.

4. See, for example, Chebib and Sohail, "The Reason Social Media Contributed," 139–62; Philip N. Howard, Aiden Duffy, Deen Freelon, Muzammil Hassain, Will Mari, and Marwa Mazaid, "Opening Closed Regimes: What Was the Role of Social Media During the Arab Spring," Working Paper 2011.1, Project on Information Technology and Political Islam, University of Washington-Seattle, 2011, 1–30.

5. Christian S. Smith, What Is a Person? Rethinking Humanity, Social Life, and the Moral Good from the Person Up (Chicago and London: The University of Chicago Press, 2010), 375–376.

6. Esteban Manriquez, "FARC Leader Rallies Base on Twitter," Colombia Reports, Medellín, Colombia, 2012:; accessed on October 16, 2012. The FARC's Facebook page is located at; accessed on October 16, 2012. FARC member Mojuluna Alberti's Facebook page notes that he is a product manager for the FARC and that he is from Cairo, Egypt but currently living in Guadalupe, Nuevo León, Mexico. The NPS CORE Lab followed the original FARC Twitter account (@FARC_COLOMBIA) and discovered that it was simply taking long statements and cutting them up into a series of 140-character (or less) tweets. In short, it was an unsophisticated use of Twitter.

7. Seth Lucente, Robert Schroeder, and Gregory Freeman, "Syria: Crossing the Red Line," an unpublished report from the CORE Lab, Defense Analysis Department, Naval Postgraduate School, 2012. 8 Quoted in Tom Hays, "NYPD Is Watching Facebook to Fight Gang Bloodshed," Associated Press, October 2, 2012: &TEMPLATE=DEFAULT; accessed October 16, 2012.

9. Ibid. Also see Maria Ressa ("The New Battlefield: The Internet and Social Media") and Peter Kent Forster ("Countering Individual Jihad: Perspectives on Nidal Hasan and Colleen LaRose"), in this issue, both of whom describe uses of network tracking to identify terrorists.

10. See Aaron Weisburd ("Artisanal Intelligence and Information Triage") in this issue for more on cyber forensics.

11. John Arquilla, "Aspects of Netwar & the Conflict with Al Qaeda," Information Operations Center, Naval Postgraduate School, Monterey, California, 2009, 34.

12. Derek Hansen, Ben Shneiderman, and Marc A. Smith, Analyzing Social Media Networks with NodeXL: Insights from a Connected World (Burlington, Mass.: Morgan Kaufmann, 2010).

13. Christian S. Smith, The Emergence of Liberation Theology: Radical Religion and Social Movement Theory (Chicago: University of Chicago Press, 1991), 61.

14. Glenn E. Robinson, "Hamas as Social Movement," in Islamic Activism: A Social Movement Theory Approach, Quintan Wiktorowicz, ed. (Bloomington: Indiana University Press, 2004), 129.

15. Howard, et al., "Opening Closed Regimes," 1–4.

16. The cover can be seen at: Ashraf Khalil, interviewed by Audie Cornish, "Newsweek's ‘Muslim Rage' Cover Mocked on Twitter," All Things Considered, National Public Radio, September 18, 2012:; accessed on October 16, 2012.

18. James Efaw and Chris Heidger describe their success using Facebook to influence an online community ("Another Tool in the Influencer's Toolbox: A Case Study") in this issue. 19 See the site at:

20. David Kirkpatrick, "The ‘Facebook Effect': Standing up against the FARC," Facebook blog post, Menlo Park, California, June 8, 2010): php?post=397218557130; accessed on October 16, 2012.

21. David Galula, Counterinsurgency Warfare: Theory and Practice (Westport, Conn.: Praeger Security International, 2006, originally published in 1964); David Kilcullen, Counterinsurgency (Oxford and New York: Oxford University Press, 2010); Eric P. Wendt, "Strategic Counterinsurgency Modeling," Special Warfare (September 2005): 1–13; available at:; accessed October 16, 2012. NOTES Vol. 2, No. 4 | CTX 73