Cobwebs: Israeli firm connects online dots to stop terror attacks

Many terror events have preliminary hints online, and the subterranean networks of influence could be detected in advance, Israeli firm Cobwebs says.

By Keren Tsuriel Harari and Meir Orbach, Ctech

On Friday, March 15, at 1:33 p.m., 28-year-old Brenton Harrison Tarrant went live on Facebook. By the end of the broadcast, Tarrant’s actions were already known as the Christchurch mosque shootings.

The live-streamed broadcast, captured with a head-mounted Go-Pro camera, showed Tarrant driving in his car, in full military gear, listening to white supremacist music as he parked in the vicinity of the Al Noor Mosque in Christchurch, New Zealand.

Tarrant was seen picking up a semi-automatic rifle, entering the mosque, and indiscriminately shooting those present for six minutes.

As mentioned above, the massacre was broadcast live on Facebook as well as on online imageboard 8chan, known as a hub for far-right activists. As users watching the live broadcast wished him luck and called him a “f**ing hero,” Tarrant returned to his car, shooting at bystanders on his way to the Linwood Islamic Centre, 5 kilometers east of Al Noor, where he continued his spree.

While allegedly on his way to a third location, Tarrant was pulled over by police and arrested at 2:02 p.m. He managed to kill a total of 51 people and injure 49 in just 29 minutes, 17 of which were live-streamed.

For two years, Tarrant outlined his plans on far-right online forums. “Well lads, it’s time to stop shitposting and time to make a real life effort post,” Tarrant reportedly wrote in a post on 8chan, published minutes before the first attack and since removed.

“I will carry out an attack against the invaders, and will even live stream the attack via facebook… by the time you read this I should be going live,” the post continued.

In a manifesto posted just before the shooting, Tarrant claimed he was inspired by Anders Behring Breivik, who in July 2011 murdered 77 people and injured over 300 in a series of Islamophobic attacks in Norway.

Tarrant even claimed he had received Breivik’s blessing, and wrote his name on one of the ammo magazines he used for the massacre. The name of Alexandre Bissonnette, who killed six people and injured 19 in a Quebec mosque in 2017, was also written on the magazine.

Tarrant was not the only one to be inspired by Breivik and Bissonnette, who were also mentioned by Aztec High School shooter William Atchison, who killed two students before shooting himself in 2017, and David Ali Sonboly, who in 2016 committed suicide hours after killing nine people and injuring 36 at a mall in Munich.

In much the same way as Tarrant was inspired by lone-wolf terrorists, he himself became a rising star in the far-right communities. John T. Earnest, who in April committed The Poway synagogue shooting in California, killing one woman and injuring three more people, was allegedly inspired by Tarrant, as well as by Robert Gregory Bowers, the orchestrator of the Pittsburgh synagogue shooting six months prior.

Another so-called “f***ing hero” in these online communities is Elliot Rodger, who in 2014 killed six people and injured 14 near the campus of the University of California, Santa Barbara, in Isla Vista. Rodger, who killed himself at the end of his murderous spree, went on to inspire Scott Paul Beierle (who shot two women inside a Tallahassee, Florida yoga studio in 2014), and Alek Minassian (rammed his van into pedestrians in Toronto in 2018, killing 10 and injuring 16 more).

But the impact of these senseless acts of violence goes beyond inspiring new similarly motivated attacks—they also trigger a backlash. Three days after the Christchurch mosque shootings, Gokmen Tanis, a Muslim man, opened fire inside a tram in Utrecht, the Netherlands, killing four people and injuring 16 more.

The April 2019 terror attack in Sri Lanka, which targeted people of Christian faith as well as foreign nationals and was since dubbed the Easter bombing, is considered an act of retaliation to the Christchurch attack. Two hundred fifty-eight people were killed and at least 500 were wounded in the coordinated attack.

Terror nurtured online

The aforementioned murders were carried out by white supremacists and Muslim terror organizations, xenophobes and misogynists, but they all have one thing in common. They germinate and mature online.

The internet has made it so terrorists in one part of the world become heroes to would-be killers in another. In its role as a platform for others to be inspired, encouraged, and tutored, it has come to offer the same things to people that have enough hatred and violent tendencies to take that inspiration in another direction

This is the butterfly effect of evil, according to Israeli web intelligence startup Cobwebs Technologies Ltd. According to the company, many terror events have preliminary hints online, and the subterranean networks of influence could be detected in advance, if one knows how, where, and what to look for. With the right technology, states Cobwebs, would-be terrorists could be detected and apprehended before they execute their malicious plans.

Founded in 2015, Cobwebs develops a search engine that can scour the dark web and deep web for potential activity it deems terror-related or otherwise illegal. According to the company, this engine can perform background checks on individuals and alert to potentially harmful interactions in real time.

Cobwebs markets this service to security agencies and intelligence services, but also to governments and corporations such as banks, which are using it to detect incidents of money laundering, fraud, terror funding, and similar criminal activities. It employs some 100 people across several global offices: Herzliya, a town in the Tel Aviv area, New York, and Singapore. In March, Cobwebs raised $10 million from U.S.-based IBEX.

Cobwebs’ service starts with a simple search window. A user can type in any piece of information—a name, a hashtag, a location, a date, or an image, for example—and the system will go hunting. It searches the open web, as well as the deep and dark web.

It can search texts in 30 languages, scour photos and videos using machine vision and face recognition technologies, and put together a vast amount of information in seconds. Cobwebs, it says, can create in a single moment what intelligence officers used to generate manually over countless hours: a map that outlines the networks of influence of terrorists all over the world.

Predicting protests

And not just terrorists. By mapping the ripple effect of violence, Cobwebs says it can predict global protest and civil uprising events such as the Arab Spring in 2011.

“You won’t believe what’s out there, right in the open,” Cobwebs’ co-founder and president Omri Timianker told Calcalist in a recent interview. “Gangs making death threats, giving the exact details of what they’re going to do… Terrorists and antisemites spewing their opinions, doing whatever they want.”

While this technology can help save lives, it can also serve other, less noble goals, especially in the hands of unscrupulous regimes and corporations.

“We only deal with legitimate bodies in Western countries,” CEO Udi Levy stressed. “We do not deal with third-world countries.”

According to Timianker, the Christchurch mosque massacre was the key to understanding Cobwebs’ system and what it is capable of doing. When the shooting incident in Utrecht happened just days after the Christchurch attack, a team of company analysts wondered if they could be connected. They used the company’s technology to explore words and phrases related to the attacks.

Once Cobwebs’ analysts linked the first two attacks, they went on to trace the invisible lines connecting 12 global attacks, going as far back as the 2011 attacks in Norway and spreading across Europe, the U.S., Asia, and Oceania. “Most of the propagators were white supremacists, neo-nazis, and haters of various kinds,” Timianker said. “Some talked with other terrorists, copied past attacks, or reacted with counterattacks. That’s how we developed our theory.”

According to Cobwebs’ operating theory, to maximize the ability to trace violent incidents and detect future attacks, each terror event must be examined according to two timeframes: immediately and in the long run. “The hour after an event occurs is the golden hour in which you can learn a lot about the person who did it,” Timianker said.

“After an hour has passed, social networks remove information, and later, engagement with the relevant information is a lot more commonplace because people open more and more pages about that person. Intelligence gathering-wise, there’s nothing more to do after that hour,” he explained.

“In the long run, you need to follow an event and see what kind of people react to it. You cannot arrest a person for things they say, but you can tag them, follow up to see if they are becoming more extreme, how their profiles are changing.”

International cooperation needed

According to Timianker, the main hurdle challenging real-world investigators and intelligence and security agencies is isolation. “The internet is a flat world where everything is close together, and it all happens fast,” he said.

“Investigators all over the world look within the borders of their own country, and are not exploring influences from other places.” According to him, countries need to develop a joint response protocol for multinational events.

The goal, says Timianker, is to identify the up and coming terrorist. “They leave behind clues, and you can tell something is about to happen,” he said. The system has already helped prevent several school shooting events and crack a drug investigation, he added.

Like the rest of Cobwebs’ leadership, Timianker himself served in an IDF special forces reconnaissance unit, before joining the Shin Bet. His experience in the Israeli security forces has made him aware of the work of intelligence analysts, and the need for better data processing tools.

“Big data is complicated, which is why analysts did tap into it, they simply opened eight tabs on their computer and researched the old way,” Timianker said. “With our system, a single analyst is equal to 1,000 analysts, and all the hard work is performed by the technology.”

There’s no avoiding the fact that Cobwebs’ technology is designed to systematically and efficiently track people in ways they do not suspect, even if the information they are analyzing is public. Law enforcement agencies can track a hashtag, for example, in order to detect protests and civil uprisings, and then use the information for more than simply keeping public order.

“A protest like France’s yellow vests movement is something that can crash a country, and such uprisings are interesting to any country where there are protests, and you can predict that,” Timianker said. “Today, if you control the hashtag you control the Twittersphere, you are an influencer that can carry people towards a cause, and we need to know who’s behind them. If that person is being activated by a country or an agency.”

“We do not violate privacy, we only reach public information that could be viewed even without us, Timianker said. “But even an automaker cannot guarantee that a person buying their car will obey traffic laws.”

Israeli startupTerrorism