This preview shows page 1. Sign up to view the full content.
Unformatted text preview: Social Network Analysis
Application to CounterTerrorism & Law Enforcement What is a social network? A social network is a social structure made of nodes (which are generally individuals or organizations) that are tied by one or more specific types of interdependency, such as values, visions, idea, financial exchange, friends, kinship, dislike, conflict, trade, web links, sexual relations, disease transmission (epidemiology), or airline routes. Social network analysis Social network analysis views social relationships in terms of nodes and ties. Nodes are the individual actors within the networks, and ties are the relationships between the actors. There can be many kinds of ties between the nodes. Research in a number of academic fields has shown that social networks operate on many levels, from families up to the level of nations, and play a critical role in determining the way problems are solved, organizations are run, and the degree to which individuals succeed in achieving their goals. In its simplest form, a social network is a map of all of the relevant ties between the nodes being studied. The network can also be used to determine the social capital of individual actors. These concepts are often displayed in a social network diagram, where nodes are the points and ties are the lines. a social network diagram Terrorist organizations are wellsuited to study using social network analysis, as they consist of networks of individuals that span countries, continents, and economic status, and form around specific ideology. Terrorist organizations are different from hierarchical, statesponsored appointments in characteristics such as leadership and organizational structure. Social network analysis can provide important information on the unique characteristics of terrorist organizations, ranging from issues of network recruitment, network evolution, and the diffusion of radical ideas. Specifically, social network analysis can be used to understand terrorist networks, inform U.S. homeland security policy, and form the basis of a more effective counter measure to net war. Terrorists & SNA? The power of SNT? The power of social network theory stems from its difference from traditional sociological studies, which assume that it is the attributes of individual actors whether they are friendly or unfriendly, smart or dumb, etc. that matter. Social network theory produces an alternate view, where the attributes of individuals are less important than their relationships and ties with other actors within the network. This approach has turned out to be useful for explaining many realworld phenomena, but leaves less room for individual agency, the ability for individuals to influence their success, so much of it rests within the structure of their network. Social networks have also been used to examine how companies interact with each other, characterizing the many informal connections that link executives together, as well as associations and connections between individual employees at different companies. These networks provide ways for companies to gather information, deter competition, and even collude in setting prices or policies. The origin of contemporary social network analysis can be traced back to the work of Stanley Milgram. In his famous 1967 experiment, Milgram conducted a test to understand how people are connected to others by asking random people to forward a package to any of their acquaintances who they thought might be able to reach the specific target individual. In his research, Milgram found that most people were connected by six acquaintances. This research led to the famous phrase "six degrees of separation," which is still widely used in popular culture. Six degrees of separation The distance of Web pages the Notre Dame physicist AlbertLaszlo Barabasi studied one obvious network -- the Internet -- and found that any two unrelated Web pages are separated by only 19 links. Another important step in the development of social network analysis was the work of Mark Granovetter on network structures. In his widelycited 1973 article "The Strength of Weak Ties," Granovetter argues that "weak ties" your relationships with acquaintances are more important than "strong ties" your relationships with family and close friends when trying to find employment. Granovetter's article and subsequent research extended this argument by positing that more disperse, nonredundant, open networks have greater access to information and power than smaller, denser, and more interconnected networks because they supply more diversity of knowledge and information Weak ties D.J. Watts' small world hypothesis builds upon both Milgram's "six degrees of separation" concept and Granovetter's "weak ties" argument by stating that most networks in the natural and manmade world are highly clustered yet farreaching. These networks have a "clustered" center, where most nodes are neighbors, tightly interconnected. In addition, each has weak ties that can connect it to any node in the network in a few short connections. For example, if a node represents a person, a person's friendship network is generally tightly connected, with common friends, similar backgrounds, and overlaps. However, despite this "clustered" inner core, as shown with Milgram's "six degrees of separation," a person can reach a stranger in the world through only a few small steps/connections. Watts' small world argument has been extended by numerous researchers to help understand the structure and behavior of various networks, including the spread of AIDS, the collapse of financial markets, and the spread of information. Small world While social network analysis has been present in some form for decades, the concept entered popular culture in the beginning of the twentyfirst century. Malcolm Gladwell's bestseller The Tipping Point uses basic network ideology to describe how realworld social epidemics occur, such as the popularity of Airwalk shoes and the decline of crime in New York City. Gladwell describes the importance of three types of people: connectors, mavens, salesman Gladwell builds upon Watts' research as he describes connectors those with wide social circles as the hubs of the human social network and responsible for the small world phenomenon. The tipping point The use of social network analysis in the mainstream has increased with the growth of a number of new online Internet sites based on social network principles. For example, MySpace, Friendster, and Facebook are three websites that allow users to connect with friends and friends of friends to share photos, blogs, user profiles, and messages. Especially important in teenager culture, these sites map out each user's network of friends and acquaintances. According to Alexa.com, a web trafficking service, as of April 2006, MySpace is the third most popular website in the U.S. and the sixth most popular in the world ("Top 500 Sites"). Further, similar websites have been created in the employment field. Sites such as LinkedIn allow members to map their professional connections and allow employers and employees to use their associations as references in job matching. Social network sites Networks and Netwars The importance of SNA in fighting the war on terrorism was recognized even before the attacks of September 11, 2001. John Arquilla and David Ronfeldt's work Networks and Netwars, which was released in 2001 before the terrorist attacks, describes the increased network principles in modern criminal organizations. The premise of the book is that war is no longer a headtohead battle of two powers. There is no formal hierarchicalbased enemy like the U.S.S.R. during the Cold War. Modern war is netwar, a lower intensity battle by terrorists, criminals, and extremists with a networked organizational structure. These networked structures are often leaderless and able to attack more quickly. Novel, asymmetric approaches are needed to combat a networkbased criminal organization SNA in fighting terrorism After the attacks of 9/11, academia, the government, and even mainstream media began to discuss the importance of social network analysis in fighting terrorism.vMainstream media outlets such as the Washington Post and the Dallas Morning News ran articles describing the potential benefits of network science.10 Authors of popular press network books, such as AntonioLaszlo Barabasi (Linked), were interviewed extensively, on television and radio programs, on how we could use the knowledge of social networks to fight terrorism. Further, when the National Security Agency's warrantless eavesdropping program hit the news in 2006, the importance of social network analysis in fighting terrorism reemerged in a New York Times article discussing the ability of network analysis to map and potentially make meaning out of the millions of communications NSA intercepts daily between individuals. Map 9.11 After Sept. 11, Valdis Krebs, a Cleveland consultant who produces social network "maps" for corporate and nonprofit clients, decided to map the hijackers. He started with two of the plotters, Khalid alMidhar and Nawaf Alhazmi, and, using press accounts, produced a chart of the interconnections -- shared addresses, telephone numbers, even frequentflier numbers -- within the group. All of the 19 hijackers were tied to one another by just a few links, and a disproportionate number of links converged on the leader, Mohamed Atta. Shortly after posting his map online, Krebs was invited to Washington to brief intelligence contractors. Interview with Valdis Krebs
Interview with Social network analysis consultant Valdis Kreb at Webcamp on Social networks 2007 at Digital Enterprise Research Institute Part one Part two SNA Method Applied to CounterTerrorism & Law Enforcement General method: Determine nodes & links Next classify links EX: Victims & suspects names, address, phones# Always look for new nodes & links Timing, Frequency, Volume, Content EX: landline & cell calls, emails, texting, IMs, F2F encounters, family relationships, friends, co workers, independent professional colleagues ... Kreb's Mapping Method Identify, Distinguish Task from Trust Ties Networks to Map Similar relationships mapped for governments, business organizations, NGOs Comprehensive, exhaustive & accurate data acquisition often very challenging even for legal acts, but is THE challenge in analysis of covert conspirator activities Trust Task Money & Resources Strategy & Goals Data collection Data collection is difficult for any network analysis because it is hard to create a complete network. It is especially difficult to gain information on terrorist networks. Terrorist organizations do not provide information on their members, and the government rarely allows researchers to use their intelligence data. A number of academic researchers focus primarily on data collection on terrorist organizations, analyzing the information through description and straightforward modeling. Valdis Krebs was one of the first to collect data using public sources with his 2001 article in Connections. In this work, Krebs creates a pictorial representation of the al Qaeda network responsible for 9/11 that shows the many ties between the hijackers of the four airplanes. After the Madrid bombing in 2004, Spanish sociologist Jose A. Rodriguez completed an analysis similar to Krebs' by using public sources to map the March 11th terrorist network. In his research, he found diffuse networks based on weak ties amongst the terrorists. Data collection Despite their many strengths, Krebs' and Sageman's works have a few key drawbacks. By dealing with open sources, these authors are limited in acquiring data. With open sources, if the author does not have information on terrorists, he or she assumes they do not exist. This can be quite problematic as the data analysis may be misleading. If one cannot find an al Qaeda operative in the U.S. in publicly available sources, the researcher could assume there is no al Qaeda network. However, it is highly probable this is not the case, since terrorists generally try to keep a low profile before committing an attack. The data collectors can also be criticized because their work is more descriptive and lacks complex modeling tools. Fostering relationships with modelers could augment the work being conducted by data collectors, as statistical analysis might be able to take into account some of the limitations of the data and provide an additional analytical framework. Complex models Complex models have been created that offer insight on theoretical terrorist networks. Kathleen Carley heads one of the largest computational model organizations that models terrorist networks, Computational Analysis of Social and Organizational Systems (CASOS) at Carnegie Mellon University They looked at how to model the shape of a covert network when little information is known, through predictive modeling techniques based on inherent network structures. Using a computational tool created at CASOS known as DyNet, they looked at ways to estimate vulnerabilities and destabilize terrorist networks. They also developed a citylevel network model of chemical and biological attacks (BioWar) A common problem for the modelers is the issue of data. Any academic work is only as good as the data, no matter the type of advanced methods used. Modelers often do not have the best data, as they have not collected individual biographies and do not have access to classified data. Many of the models are created datafree or without complete data, yet do not fully consider human and data limitations. The implication of this is that the results can be potentially misleading, as they cannot take into account behavioral and contextual issues that might affect the network structure and activity. For example, it would be quite difficult to model the network structure and evolution of al Qaeda since many of the organizations that claim ties to al Qaeda are lying and do not actually have those ties. It can be quite difficult differentiating these groups from other, truly loosely affiliated groups. Drawbacks Link analysis Despite the seeming novelty of social network analysis, the federal government has used link analysis, a predecessor of SNA, for nearly fifty years. Karl Van Meter describes the two main types of link analysis: the village survey method and traffic analysis. The village survey method was created and used by Ralph McGehee of the CIA in Thailand in the 1960s to understand family and community relationships. He conducted a series of openended interviews and in a short time was able to map out the clandestine structure of local and regional Communist organizations and associated "sympathetic" groups. Traffic analysis Traffic analysis (also known as communication link analysis) began during World War II and its importance continues to this day. This technique consists of the study of the external characteristics of communication in order to get information about the organization of the communication system. It is not concerned with the content of phone calls, but is interested in who calls whom and the network members, messengers, and gatekeepers. Traffic analysis was used by the British MI5 internal security service to combat the IRA in the 1980s and 1990s and continues to be used across the world by law enforcement agencies including the U.S. Defense Intelligence Agency (DIA) Office of National Drug Control Policy Analyst Notebook The Analyst Notebook is the primary software used for link analysis. this software is recognized as one of the world's leading analytical tools and is employed in more than 1,500 organizations ("Contraband Enforcement"). Social network analysis improves upon link analysis by moving from single variable analysis to multivariate analysis, allowing the individual to control for many factors at once. The change from single variable to multivariate analysis is quite significant when researching terrorism: a number of factors affect terrorism, not one single factor. For example, the propensity for one to participate in a terrorist activity might not be strongly affected by the single variable of being related to a terrorist member. However, the combination of multiple variables such as poverty, type of government, combined with the link to a terrorist member may cause a person to participate in a terrorist activity. Multivariate analysis allows us to take into account these multiple variables and their effects when controlling for another variable. As a group in class, develop a list of relevant key search terms that are likely to produce documents that describe and critique this challenge. Reading before next class Next class: In Class Exercise #1 SNA as an approach to combat terrorism Mapping Networks of Terrorist Cells Can Network Theory Thwart Terrorists? The NSA's math problem Pentagon sets its sights on social networking websites ICE#1 Questions Please submit a document with questions serving as headings and responses of approximately one or two paragraphs (whatever is necessary to answer the question completely) beneath the headings. Answer at least 4 of the following questions. 2 pages, double space. Please following the writing guide. How does network theory & analytical methods inform SNA? How can SNA be made useful tool for counterterrorism & law enforcement? What valuable information/patterns about terrorist groups can SNA reveal? What data (type & source) are needed to implement SNA? What tools/software are available for SNA? What prevents access to useful data? What are the limitations of social network analysis? What competing public policies are balanced in enabling SNA? What countermeasures might be used by terrorists & criminals to thwart SNA? Find useful analytics from personal P2P experiences & social networking practice (e.g., "MyFaceBook?") The main limitation of social network analysis is the same that applies to any new and innovative technology: social network analysis is just one tool that can be used to understand terrorism, and is just one piece of the puzzle. Subject matter experts are needed to provide a context for the research. Furthermore, the basic assumption of network analysis regarding terrorism may not be completely valid. Despite their nonhierarchical approach, terrorist organizations are not completely organized in a network structure. There are still central headquarters and training facilities for most terrorist organizations. Also, social network analysis must attempt to address the underlying root cause of terrorism. It is helpful to understand how a network evolves and how to destabilize a network. It is more helpful, however, to understand how networks recruit participants and why people wish to join terrorist networks. Trust Type of Data Data Sources Prior Contacts EX: Family, Neighborhood, School, Military, Clubs, Organization, Professional Organizations, Recreation Public Records Court Records Obstructions or Complications Accessibility of Form of Records (e.g., paper, courthouse, cost) Privacy Law or Confidentiality Obligations Remote Location of Record Repository or encoded (foreign) language Task Type of Data Data Sources Transaction Logs & task content EX: phone records, email, chat/IM, texting, clickstream, travel plans/itineraries/records Server & ISP logs, keyboard capture, TelCo records, travel agency/carrier records, Validation often needed through direct human intelligence requiring observer's onsite presence, travel, witness verification, local video, meetings, common events Obstructions or Complications Money & Resources Type of Data Data Sources Money transfer data, transaction records Bank account transfers, credit card use, POS, PayPal, wire transfers, cash use Bank records, expenditure & receipt patterns, transfer orders Financial Privacy Rules, Bank Secrecy & Various Confidentiality Duties Marked money, currency serial numbers, MoneyLaundering techniques, Alternative Banking, Havens Obstructions or Complications Strategy & Goals Type of Data Data Sources Publications & speeches, website interest, ideological organization membership, video, communication content, travel agency/carrier records, Public writings, private correspondence, videos, attendee reports & analysis Evidence largely circumstantial inferred from associations, declarations & interests Obstructions or Complications ...
View Full Document
- Spring '08