  Online extremists in social networks pose a new form of threat to the general
public. These extremists range from cyberbullies who harass innocent users to
terrorist organizations such as the Islamic State of Iraq and Syria (ISIS) that
use social networks to recruit and incite violence. Currently social networks
suspend the accounts of such extremists in response to user complaints. The
challenge is that these extremist users simply create new accounts and continue
their activities. In this work we present a new set of operational capabilities
to deal with the threat posed by online extremists in social networks.
  Using data from several hundred thousand extremist accounts on Twitter, we
develop a behavioral model for these users, in particular what their accounts
look like and who they connect with. This model is used to identify new
extremist accounts by predicting if they will be suspended for extremist
activity. We also use this model to track existing extremist users as they
create new accounts by identifying if two accounts belong to the same user.
Finally, we present a model for searching the social network to efficiently
find suspended users' new accounts based on a variant of the classic Polya's
urn setup. We find a simple characterization of the optimal search policy for
this model under fairly general conditions. Our urn model and main theoretical
results generalize easily to search problems in other fields.
