The Pennsylvania State University
The Graduate School
The College of Information Sciences and Technology
A COMPARATIVE SOCIAL NETWORK ANALYSIS OF THE 2008 MUMBAI, 2015 PARIS, and
2016 BRUSSELS TERRORIST NETWORKS
A Thesis in
Information Sciences and Technology
by
Tyler J. Yazujian
2017 Tyler J. Yazujian
Submitted in Partial Fulfillment of the Requirements for the Degree of
Master of Science
May 2017
The thesis of Tyler J. Yazujian was reviewed and approved* by the following:
Peter Forster Senior Lecturer of Information Sciences and Technology Thesis Adviser
Jessica Kropczynski Lecturer of Information Sciences and Technology T {
Donald Shemanski Professor of Practice of Information Sciences and Technology
Andrea H. Tapia Associate Professor of Information Sciences and Technology Head of the Graduate Department in the College of IST
*Signatures are on file in the Graduate School
ii
ABSTRACT
This research builds a further understanding about analyses to characterize networks with limited data available. It uses social network analysis to retrospectively compare the networks of the terrorist attacks in Mumbai 2008, Paris November 2015, and Brussels March 2016, to better recognize the roles and positions of the networks’ actors. Expanding on previous analysis of the Mumbai terrorist network, this paper identifies new methods to study dark networks by applying social network analysis to the
Mumbai, Paris, and Brussels networks. Three levels of analysis are conducted: (1) an attribute-level correlation to examine correlation between age and organizational role across cells; (2) key player analysis to investigate whether key players share similar roles; and (3) application of structural block models to the networks to identify cellular combat teams.
iii
TABLE OF CONTENTS List of Figures………………………………………………………………………………v
List of Tables………………………………………………………………………………vi
Acknowledgments………………………………………………………………………... vii
Chapter 1 Introduction ...... 1
Chapter 2 Events Orientation ...... 3
2.1 Mumbai, 2008 ...... 3 2.2 Paris, 2015 ...... 4 2.3 Brussels, 2016 ...... 5
Chapter 3 Literature Review ...... 7
Chapter 4 Research Questions ...... 16
Chapter 5 Methodology ...... 19
Chapter 6 Results ...... 21
6.1 Attribute-Level Correlation Analysis (RQ1) ...... 22 6.2 Key Player Analysis (RQ2) ...... 24 6.2.1 Key Player Negative ...... 24 6.2.2 Key Player Positive ...... 28 6.3 Structural Blockmodeling (RQ3) ...... 30
Chapter 7 Discussion and Conclusion ...... 34
References ...... 37
iv
LIST OF FIGURES
Figure 1-1: Number of Terror attacks globally since 1990. Global Terrorism Database START (LaFree & Dugan, 2007) ...... 1
Figure 2-1: Target Locations in Mumbai (BBC News South Asia, 2008)...... 4
Figure 2-2: Target Locations in Paris (BBC News Europe, 2015)...... 5
Figure 2-3: Target Locations in Brussels (Wagner, 2016)...... 7
Figure 3-1: Number of Lone Wolf Attackers since 1950s (Worth, 2016) ...... 11
Figure 3-2: ISIS Attacks, Outside of its Self-Proclaimed Caliphate (Callimachi, 2017) ...... 11
Figure 3-3: Network with Central Node “1” that Does Not Fragment the Network (Borgatti, 2006) ...... 13
Figure 6-1: A Depiction of the Mumbai Terrorist Network (Borgatti et al., 2002) ...... 21
Figure 6-2: A Depiction of the Paris Terrorist Network (Borgatti et al., 2002) ...... 22
Figure 6-3: A Depiction of the Brussels Terrorist Network (Borgatti et al., 2002) ...... 22
v
LIST OF TABLES
Table 6-1: Results for removal of one key player, based on fragmentation (Borgatti, S. P., 2003)...... 26
Table 6-2: Results for removal of two key players, based on fragmentation (Borgatti, S. P., 2003)...... 27
Table 6-3: Results for monitoring of one key player, based on reach (Borgatti, S. P., 2003)...... 29
Table 6-4: Results for monitoring two key players, based on reach (Borgatti, S. P., 2003). ... 30
Table 6-5: Block model output for the Mumbai network. Handler (H); Attacker (A)...... 31
Table 6-6: Block Model Output for Paris Network. Handler (H); Attacker (A)...... 32
Table 6-7: Block Model Output for Brussels Network. Handler (H); Operational Support (O); Attacker (A)...... 33
vi
ACKNOWLEDGEMENTS
I’d like to give thanks to the following people who have greatly helped me along the way. This thesis is dedicated to the following people:
My parents: You both have always loved and supported me in anything I pursued.
Dr. Pete Forster: You have been an exemplary advisor to my work and to my studies.
You have always had an open door to your students and it was a great pleasure
working with you.
Dr. Don Shemanski: Your classes sparked my interest in counterterrorism efforts and
national security. Each class provided students with an incredible learning
environment with hands on scenarios that I still and will talk about throughout
the rest of my life.
Dr. Jess Kropczynski: Your classes sparked my interest in social network analysis and
their applications to terrorist organizations. Your willingness to always help your
students in anything they needed did not go unnoticed.
Col. Jake Graham: Your classes, research, and providing of the Red Cell Lab have all
been extremely valuable to my studies. You were a mentor to me who always
went out of your way to help me in anything I was pursuing.
Alex Brown: Your help during the IST 597 course as the TA and providing me with the
Mumbai dataset set the foundation for this work.
The Penn State Football Coaches and Academic Staff: You each played a vital role in my
athletic and academic success on and off the field. Specifically, I’d like to thank
Coach James Franklin, Coach Charles Huff, Coach Sam Williams, Todd Kulka,
Molly Tye, and Coach Bill O’Brien
vii
1
Chapter 1 Introduction
Gaining and in-depth understanding of how terrorist organizations and their respective cells are structured and operate is a high priority for national security entities to combat terrorism in the post-9/11 world. According to the Global Terrorism Database, the number of terror attacks worldwide has increased dramatically since 1990 (see Figure 1-1) (LaFree & Dugan, 2007). Since 9/11, the U.S. has spent $1.6 trillion on the counterterrorism efforts in hopes to halt the upward trend (Belasco, 2009). Terror attacks have increased despite spending, which has raised the call for academic and practitioners alike to improve methods to understand terrorism and the social infrastructure that allows them to thrive. This paper works to advance this area by exploring social network analysis (SNA) techniques not commonly used to explore dark networks. It presents a comparative analysis of the social infrastructure involving in three different terror networks through three methodological techniques and describes their contribution to understanding networks. Such an understanding may help future initiatives to disrupt activities before violence occurs.
Figure 1-1: Number of Terror attacks globally since 1990. Global Terrorism Database START (LaFree & Dugan, 2007)
2
SNA is a methodology that allows researchers to quantify and visualize social infrastructure, which creates unique opportunities to begin untangling the complexity that underlies terrorism. Although previous work has opened the door to the application of SNA to terrorist networks, Ressler (2006) contends that more work should be done to understand the causes of structuration within terrorist networks. This involves understanding: How does a network structure itself? How is information spread throughout the network? And thus, how can a network be destabilized (Ressler, 2006)? The Mumbai,
Paris, and Brussels’ network structures, allowance for information diffusion, and vulnerability to be destabilized all point to the methodologies of this research.
The three cases of Mumbai, Paris, and Brussels were chosen for this analysis because of their similarity to one another in terms of operational structure, execution, and effectiveness. By leveraging existing data made available by Azad and Gupta (2011) in A quantitative assessment on 26/11 Mumbai attack using social network analysis, this research applies SNA techniques to the Mumbai terrorist network, while also building two additional networks around the 2015 Paris and 2016 Brussels attacks and offering a comparative analysis of the three networks. The overarching goals of this research are threefold: (1) offer empirically based network analysis to leverage insight towards counter-terrorism efforts; (2) better understand the structuration of contemporary terror networks; and (3) offer future direction for SNA-based terrorism research. This study results in an evidenced-based approach to improved understanding of terror networks which should positively contribute to the development of counter-measures that disrupt and degrade activities and ultimately erode network’s effectiveness.
Building upon the progress made in applying social network analysis to terrorism, as well as utilizing previous insightful analyses conducted (i.e. comparative analyses), this study applies retrospective comparative analysis to advanced social network analysis techniques to evaluate terrorism and the related networks in a more comprehensive manner. By using social network analysis to aid in the understanding and operational tendencies of small dark networks, analysts will better visualize their
3 findings and identify new and alternative hypotheses regarding future operations. The larger objectives of this paper are to explore commonalities that exist between the selected terror networks; explore common attributes among actors identified for removal; compare and contrast terror cell structuration. Based on these observations, we discuss comparative analysis as a tool for advancing terrorism related social network analysis research.
Chapter 2 Events Orientation
2.1 Mumbai, 2008
From November 26 – 29, 2008, ten members of Lashkar-e-Taiba (LeT) conducted a 60-hour siege of India’s commercial center, Mumbai. The attack shook India’s confidence in its counterterrorism capabilities as well as demonstrating LeT’s capabilities. In its immediate aftermath, Mumbai was regarded a “game changer” by counterterrorism specialists. LeT is a known terrorist group which focuses on the liberation of Indian-controlled Kashmir and is based in Pakistan (Azad & Gupta, 2011). Planning to attack Mumbai by sea to circumvent Indian defenses, the terrorists sailed from Karachi and hijacked an
Indian fishing trawler murdering its crew to further disguise their infiltration (Rabasa et. al. 2009). Upon landing, members separated into five teams of two to launch mobile attacks targeting five locations.
These include the Taj Mahal Hotel, the Oberoi Trident Hotel, Café Leopold, Chhatapati Shivaji Terminus, and the Nariman Chabad House (Azad & Gupta, 2011). Ismail Khan and Ajmal Amir Kasab attacked the
Chhatapatri Shivaji Terminus, Javed and Abu Shoaib attacked the Taj Mahal, Abu Umer and Hafiz
Arshad attacked the Leopold Café, Nasir and Baba Imran attacked the Oberion Trident Hotel, and
Fahadullah and Abdul Rehman attacked the Nariman House (Azad & Gupta, 2011). Figure 2-1 shows the geospatial locations of these targets.
4
Figure 2-1: Target Locations in Mumbai (BBC News South Asia, 2008).
The attackers were in constant contact with their respective handlers (Wassi, Zarar, and Abu
Kaahfa) in Pakistan during the attack. Using live news feeds from Mumbai, these handlers gave orders via telephone to the gunmen, instructing them to attack and execute civilians for greater media coverage, and ultimately to commit suicide (Roggio, 2009). While Azad and Gupta’s (2011) analysis advanced the literature in this area, their insights arose primarily from the discussion of centrality measures commonly associated with SNA and did not necessarily address structuration issues (e.g. network evolution) mentioned by Ressler (2006).
2.2 Paris, 2015
The recent attacks in Paris consisted of a dark network similar in size and structure to those in the
Mumbai attacks, hence presenting an opportunity to conduct comparative analysis of the networks, while also delving into insights beyond descriptive SNA measures such as centrality of actors in terror networks. The Paris attacks were conducted by twelve members of the Islamic State of Iraq and the
Levant (ISIS) on November 13, 2015. Abdelhamid Abaaoud, who was killed in a police raid after the
5 events, was the attack’s operational mastermind. These members were organized into three teams of three, with the remaining three individuals (Salah Abdeslam, Mohamed Abrini, and Mohamed Belkaid) acting as logistic supporters (Nossiter, Breeden, & Bennhold, 2015). The three teams separated to attack three separate locations: (1) the Bataclan Theatre; (2) the Stade de France; and (3) several cafes
(Boulevard Voltaire, Petit Cambodge, Le Carillon, and Rue Fontaine au Roi) (BBC News Europe, 2016).
Samy Amimour, Ismail Omar Mostefai, and Foued Mohamed-Aggad attacked the several cafes, Bilal
Hadfi, M al Mahmod, and Ahmad al-Mohammed attacked the Stade de France, and Brahim Abdeslam,
Abdelhamid Abaaoud, and Chakib Akrouh attacked the Bataclan Theatre (BBC News Europe, 2016). The attackers reportedly used assault rifles and then detonated suicide vests outside their respective target locations (Nossiter et al., 2015). Figure 2-2 outlines the locations of the targets.
Figure 2-2: Target Locations in Paris (BBC News Europe, 2015).
2.3 Brussels, 2016
On March 22, 2016, Brussels’ Maelbeek Metro Station and the Zaventem International Airport were attacked nearly simultaneously by two separate squads of suicide bombers. Two explosive vests
6 were set off in the airport while one was set off in the metro station, killing over 30 people and injuring over 260 (Austin, 2016). The two separate attacks were conducted by a single ISIS Brussels cell. Ibrahim el-Bakraoui, Najim Laachraoui, and Mohamed Abrini were tasked with attacking the airport, while
Khalid el-Bakraoui and Osama Krayem attacked the metro station about an hour later (Gardham, 2016).
Abrini failed to execute his attack, instead leaving a bag of explosives behind and fleeing the airport.
Abrini’s connection to the broader network became apparent after his capture by police in a raid in
Anderlecht, a town near Brussels, in April 2016 (Gardham, 2016). Abrini drove Salah Abdeslam to Paris two days before the Paris attacks. In Paris, Salah drove the attackers to various locations for attacks.
Salah, after fleeing the Paris attacks, provided Abrini and the other attackers with transportation to the
Brussels airport (Clarke, 2016). Salah’s role in both networks is important to note because he was the link between the Paris cell and the Brussels cell by providing transportation and logistics.
During the investigation, Abu Souleymane al-Faransi was identified as an “external operations figure” who had planned and orchestrated the Brussels attacks (Callimachi, 2016). Ibrahim el-Bakraoui left behind a computer that contained voice recordings of the attackers identifying possible targets and different plans of attack that were given to Souleymane for review before proceeding with any of the attacks (TTU Online, 2016). According to the US State Department, Souleymane also was found to have helped in the early stages of planning the Paris attacks (Callimachi, 2016). A hostage in the Bataclan
Theatre reported overhearing one of the suicide bombers ask “should we call Souleymane?” (Callimachi,
2016). Even though Abdelhamid Abaaoud seemingly took orders from Souleymane prior to the Paris attacks regarding the operation, Souleymane’s role in planning the Paris attacks was very detached and broad. The general plans for the Paris attack were passed through multiple individuals, eventually falling into the hands of Abdelhamid Abaaoud, who appears to have been a major ISIS coordinator for France and Belgium with identified connections to other attacks in France in April and August 2015 (Callimachi,
2016).
7
The analysis of the Brussels attacks allowed for the strongest look into how ISIS’ efficient and agile operational structure. The Paris cell was nearly completely eliminated after the attacks, but the
Brussels cell was extremely resilient and reacted to the latter’s decimation. After the Paris attacks, Salah
Abdeslam was able to escape the scene with Ali Oulkadi via car back to Belgium (Latin American Herald
Tribune, 2016), where he hid in a safe house for over four months (Forster & Hader, 2016). In response to
Salah Abdeslam’s arrest in March 2016, the Brussels cell demonstrated operational agility by rerouting their original attack plan to new targets in Brussels, specifically the Zaventem international airport and the
Maalbeek metro station (Forster & Hader, 2016). The Brussels cell’s quick response to Abdeslam’s arrest, gives insight into how ISIS conducts surveillance on multiple targets before choosing a final, general location to attack (Forster & Hader, 2016). Figure 2-3 outlines the Brussels attacks against the airport and the metro.
Figure 2-3: Target Locations in Brussels (Wagner, 2016).
Chapter 3 Literature Review
Social network analysis research has been very effective in analyzing various types of networks and offered beneficial strategies to either enhance or disrupt the network depending on its type. However, there have not been any extensive attempts to compare similar dark networks using SNA. This gap in the
8 literature can be bridged by combining the construction and analysis of three terrorist operations with the techniques of social network analysis.
Terrorism has been prevalent and documented throughout history. Burgess (2003) traces terrorism back to the Sicari and Zealots, first century Jewish groups. In spite of its prevalence throughout history, what defines terrorism is debated. The Global Terrorism Database (LaFree & Dugan, 2007), for example, has three different criteria when defining terrorism:
Criterion I: The act must be aimed at attaining a political, economic, religious, or social goal.
Criterion II: There must be evidence of an intention to coerce, intimidate, or convey some other message to a larger audience (or audiences) than the immediate victims.
Criterion III: The action must be outside the context of legitimate warfare activities, i.e. the act must be outside the parameters permitted by international humanitarian law (particularly the admonition against deliberately targeting civilians or non-combatants).
To be considered terrorism, all three of the criteria above need to be fulfilled. The lack of consensus surrounding the definition of terrorism can be attributed to the complexity of understanding the phenomena of terrorism, its perpetrators and their networks. Application of SNA tools and methodologies have helped researchers to quantify aspects of social relationships that previously remained descriptive in nature, while also enhancing visual representations of links and overall structuration (Ressler, 2005). SNA applications to terrorist research give insight into the internal associations of a group, which can be used to better understand how that group operates (Perliger, 2011).
9 In the early stages of SNA research, one of the most studied SNA metrics is centrality. Within centrality literature, there are many types of centrality, including degree, closeness, and betweenness as some of the most prominent. Each of these centrality measures are very different from one another, explaining and representing different aspects of a network. Degree centrality measures the direct, adjacent ties a certain node has compared to every possible tie. Closeness centrality, then, measures the shortest path between a node and all other nodes (Freeman, 1978). The maximum closeness value occurs when a node is connected to every other node with a distance of one (Freeman, 1978). The distance Freeman refers to in his closeness centrality definition is called a path, which identifies the sequence of one or more edges (1978). The shortest path between two non-adjacent nodes is called the geodesic path. The concept of geodesic paths is the basis for the definition of betweenness centrality, which was first identified by Bavelas (1948). Betweenness centrality measures how central a node is based on the number of other nodes’ geodesic paths that pass through the node of focus (Freeman, 1977). In previous SNA research on terrorist organizations, betweenness centrality was used to identify gatekeepers, or nodes that represented individuals who connect two communities (Brenton Milward and Raab, 2006), in a dark network (Bader, Kintali, Madduri, and Mihail, 2007).
In his paper “Centrality and network flow,” Borgatti (2005) researched how the different measures of centrality can be matched to their respective type of flow for which they are appropriate. He claims that each measure of centrality only represents their respective specific network flow process
(Borgatti, 2005). After constructing a list of flow processes, classifying them relative to centrality measures, and testing the presented matches, Borgatti was able to conclude that centrality measures expected node participation, rather than true node participation (2005). By using Freeman’s definitions of betweenness (1977) and closeness (1978) centrality, Borgatti found that closeness centrality can be described by a “time-until-arrival” path flow and betweenness centrality can be described by a
“frequency-of-arrival” flow of paths based on path-length (2005).
10
Recent terrorist events have sparked the research of “lone wolf” attacks due to their increasing frequency. Although the three cases of Mumbai, Paris, and Brussels were not classified as “lone wolf” attacks, it is still important to understand the tendencies that ISIS and other sophisticated terrorist groups are taking to conduct attacks across the globe. The use of an external handler, either internally within the organization like the Mumbai, Paris, and Brussels cases or externally by recruiting an outside individual to conduct “lone wolf” style attacks, is becoming more of a common practice. Previous understandings of
“lone wolf” attacks concluded that these were individuals that were working alone and wanted to conduct violent acts. However, it is now becoming more apparent that these “lone wolves” are being handled by terrorists from across the globe (Callimachi, 2017). This is the reason that the research methodologies presented in this paper were chosen. Future work that stems from this research can dive deeper into trying to better identify handlers and the appropriate actions to take from that information.
“Lone wolf” attacks were previously defined as attacks conducted by one or few individuals where the attack was uniquely plotted without coordination from outside entities or organizations (Worth,
2016). The overall number of “lone wolf” attacks has dramatically increased since the 1980s (Worth,
2016). Although lone wolf attacks have been documented back to the 1940s, their increased relevance and frequency have become a larger threat to US national security. Figure 3-1 below shows the number of
“lone wolf” attacks since the 1950s.
11
Figure 3-1: Number of Lone Wolf Attackers since 1950s (Worth, 2016)
However, this concept of the “lone wolf” attack is earning a new definition because of the Islamic
State’s recruitment methods (Callimachi, 2017). Faced with increasing pressure on the caliphate, homegrown attacks continue to rise with a varying degree of ISIS support. Recent reports on ISIS control of remote attacks contribute to a growing amount of information on the distinction between “inspired” and “directed” attacks. Initial research indicates the latter are better coordinated and perhaps more deadly. As a result, they deserve some additional consideration. After identifying these recruits, ISIS handlers fuel their violence and provide anonymous operational, financial, and ideological support via the
Internet or other means of encrypted communication (Callimachi, 2017). Figure 3-2 shows the amount of attacks since 2015 that were directed, enabled, and inspired by ISIS.
Figure 3-2: ISIS Attacks, Outside of its Self-Proclaimed Caliphate (Callimachi, 2017)
12 Figure 3-2 above does not include those attacks that were foiled by law enforcement or government agencies that were found to have direct contact with ISIS handlers (Callimachi, 2017). These
“remote-controlled” attacks were initially characterized as lone wolf attacks, only later were the direct communications between the handler and attacker discovered.
By simply recruiting those that are willing to conduct attacks, ISIS can attack larger, more desirable targets, such as the US and Europe, without having to withstand the difficulties of traveling there themselves. Some other cases have shown that ISIS handlers have also been able to direct operations that are conducted by groups of individuals as well. It was also found that some handlers were found to conduct multiple recruitment operations at a time, further exemplifying the importance of identifying key ISIS operatives that act as handlers (Callimachi, 2017).
The assigned roles in a terrorist organization are highly sought after by counterterrorism parties.
Knowing whether an individual is an attacker or a handler would benefit national security entities in counterterrorism operations. In an attempt to acquire this information, intelligence analysts seek to find variables or patterns that can be used to make assessments. For example, a younger terrorist that is newly recruited might be assessed to be a potential attacker rather than a handler. The phenomenon of terrorist organizations using younger individuals as their attackers had evolved rapidly. It is known that some terrorist organizations recruit teenagers to conduct attacks because of their illusion of innocence and ease of blending into public environments (Israel Ministry of Foreign Affairs, 2003). The more that intelligence analysts can learn about an individual, even if it is simply his/her age, can be extremely valuable in understanding and predicting behavior, roles, and associations.
Learning about an individual’s associations can be beneficial when analyzing a terrorist network.
The identification of key players in a network is a strategy that is very beneficial when looking at
13 networks and its members. Whether the network represented a company’s organizational structure or a terrorist organization, identifying who the key players are can boost the knowledge of network’s decision- making structure and operational focus. Borgatti (2006) identified the issues of using centrality measures to identify these key players and proposed a new metric that better solves the problem of key player identification. He states that in previous research that uses centrality as the metric, the network’s effects on key players were measured rather than how the key players affected the network’s cohesion (Borgatti,
2006). Another issue pointed out by Borgatti is that centrality does not always directly find all key players
(2006). The nodes with the highest centrality measures may not have the highest impact on the network if removed. Degree centrality cannot be relied upon when influencing the network’s cohesion. Figure 3-3 below exemplifies when centrality does not find the best node to remove from the network. In the figure, node 1 has a degree centrality measure of 7 (i.e., is directly connected to 7 nodes) and node 8’s degree centrality measure is 6 but the removal of node 8 eliminates connections between the subgroups thus disrupting the network.
Figure 3-3: Network with Central Node “1” that Does Not Fragment the Network (Borgatti, 2006)
Borgatti also uses Figure 3-3 to define his “Key-Player Problems.” Key-Player Problem Positive, or KPP-Pos, is focused on finding key players “for the purpose of optimally diffusing something through the network by using the key players as seeds,” (Borgatti, 2006). An example of this, as he points out, would be identifying a small population in a health agency to diffuse a new installation of practices or
14 attitudes that promote health in an efficient way. Key-Player Problem Negative, or KPP-Neg, is the
“identification of key players for the purpose of disrupting or fragmenting the network by removing key nodes,” (Borgatti, 2006). This is the more relevant of the two when talking about dark networks. Borgatti
(2006) proposes that the use of fragmentation best solves the KPP-Neg problem. For example, in Figure
3-3, node 1 would be the key player identified to best diffuse information through, while node 8 would be the key player identified to best disrupt the network with its removal. However, fragmentation does not take into account the shape of the newly created components. The subcomponents of the network would be the resulting structures that remain after the removal of a node or nodes. For example, creating two subcomponents is not as practically effective as creating two components that are not as dense. This is related to Granovetter (1973) discussing the importance of ties that are not always strong or even present.
The many metrics of social network analysis and its visualizations are widely accepted practices across a variety of research disciplines. Within the literature, centrality measures and identification of key players (i.e. important persons) have been among the most commonly used analyses for analysis dark networks (Bader, Kintali, Madduri, & Mihail, 2007; Bavelas, 1948; Brinton Milward & Raab, 2006;
Freeman, 1977, 1978). However, with the growth of terrorist’s knowledge of basic surveillance operations, additional methods of SNA should be explored (Bader et al., 2007; Bavelas, 1948; Brinton
Milward & Raab, 2006; Freeman, 1977, 1978).
Azad and Gupta (2011) applied centrality measures to the Mumbai network. They also used subgroup analysis to uncover important individuals of interest to the attacks. After creating the Mumbai network, they identified Wassi, one of the handlers, as the most central node to the network. While the researchers identified him as important, it does not fully explain why he is important. Borgatti (2006) has refined methods to identify individuals or relative importance by utilizing fragmentation for key player identification, as opposed to subgroup analysis. In developing Key Player Software, Borgatti (2006)
15 identified fragmentation as a better method to identify nodes for removal in order to obtain optimal network disruption. Ortiz-Arroyo and Hussain (2008) also utilized the fragmentation technique to find optimal key player sets within simulated terror networks.
Structural equivalence and block modeling also offer new ways of analyzing dark networks from a structural, rather than solely nodal, standpoint. Structural equivalence identifies nodes that share similar node connections to reflect their roles in the network (Sailer, 1979). This is an important strategy for analyzing dark networks because terrorist leadership is often very difficult to access. Valuable insight of the network can be found by finding nodes that share similar roles (Cunningham, Everton, & Murphy,
2016).
While SNA techniques applied to security studies have started to advance past centrality measures, the opportunity for integrating more analytic techniques remains broad. For instance, in the past, valuable insights have been garnered from the comparative analyses on topics from terroristic attributes to societal response to terrorism. Lankford (2013) analyzed “rampage” shooters and terrorist actors finding that several commonalities such as social marginalization and personal issues existed.
Papacharissi and de Fatima Oliveira (2008) evaluated U.S. v. U.K. news coverage of terrorism events and found that the U.S. news media is more likely to frame events in a militaristic manner, whereas the U.K. media is more likely to frame events in a diplomatic manner.
. By exploring the research questions posed below, this study assesses the extent to which social network analysis can be used against dark networks. By comparing three dark networks, the results of this study further aid our intelligence analysts in their duties to protect our nation. The research conducted here will benefit both the public sector and military entities in their constant defense against adversarial operations. For example, the Intelligence Advanced Research Projects Activity (IARPA) recently
16 launched the CREATE project, which is a broad agency announcement looking for research proposals that will use crowdsourcing and structured analytic techniques. According to their request for proposal:
These systems will help people better understand the evidence and assumptions that support – or conflict with – conclusions. Secondarily, they will also help users better communicate their reasoning and conclusions. STs hold promise for increasing the logical rigor and transparency of analysis. They can help reveal underlying logic and identify unstated assumptions. Yet they are not widely used in the Intelligence Community or elsewhere—possibly because current versions are cumbersome or require too much time. Crowdsourcing has the potential to solve these problems by dividing the labor, allowing dispersed groups of analysts to contribute information and ideas where they have comparative advantages. Crowdsourcing can help analysts identify and understand alternative hypotheses, arguments, and points of view. Crowdsourcing of structured techniques may facilitate rational deliberation by integrating different perspectives, so that analysis can effectively benefit from ‘crowd wisdom.’ (IARPA Broad Agency Announcement, 2016).
Chapter 4 Research Questions
As previously stated, this study’s research questions fit the IARPA proposal appropriately. By using social network analysis to aid in the understanding and operational tendencies of small dark networks, analysts will better visualize their findings and identify new and alternative hypotheses regarding future operations. The following research questions reflect the aforementioned research objectives.
Research Question 1 (RQ1): How do the terrorist groups in these three case studies organize themselves with regard to their age?
It has been noted that in typical terrorist tradecraft, younger individuals are typically the ones to conduct the physical attacks and stay in contact with their handlers and logistical supporters, who classically are older (Fotion, Kashnikov, & Lekea, 2007). For the purpose of this research, handlers are defined as the individuals who operate in a remote location away from the attack location, and are in
17 direct contact with the attackers. The attackers are then defined as the individuals who conduct the physical attacks on each location. Both of these roles are present in each of the networks. Exploring this research question using all of the networks could give insight as to how these terrorist groups organize their operations in terms of roles. If any correlation is found, generalizability to other networks of similar size can potentially be achieved.
Research Question 2 (RQ2): Does Key Player identification successfully identify similar roles in these three dark networks?
Identification of key players, who are vital to a terrorist network’s cohesiveness and information flow, is important to intelligence analysts, law enforcement, and military entities. Law enforcement and military entities would benefit from knowing the key players that are identified by their fragmentation value because they are typically interested in the physical removal of an individual. On the other hand, intelligence analysts are typically more focused on the monitoring of individuals and protecting their sources of intelligence collection (Permanent Select Committee on Intelligence, 1996). Therefore, key player identification based on a node’s reach to other nodes would benefit intelligence analysts because knowing which individuals they should monitor or diffuse misinformation to can allow them to allocate resources where needed most.
However, key players do not always need to be the leader or the node with the highest degree centrality. This research question seeks to understand if key players share the same or similar roles or other attributes in terrorist operations. With the use of KeyPlayer software (Borgatti, 2003), the identification of any key players in a network will be outputted and analyzed quantitatively and qualitatively. Key players will be determined by their impact on the network if they were removed, as well as how many other nodes they can reach in two steps or less. Typically, law enforcement and
18 military entities would benefit most from knowing which key player(s) would most disrupt the network with their removal. Dark networks are dynamic in nature, so intelligence analysts primarily benefit from knowing two key actors in the same network and either monitoring them or passing false information to them to efficiently distribute throughout the network. These analyses cover both methods of key player identification to offer valuable insight for both target audiences. Due to the time that has passed since the attacks, available intelligence allows us to understand the relative importance of key players identified using this technique.
Research Question 3 (RQ3): Does Structural Equivalence successfully identify the cellular combat teams?
The overall terrorist operations against Mumbai, Paris, and Brussels were similar in that they each conducted coordinated attacks against multiple targets. Not every node in the network was an attacker; however, the structural block modeling analysis seeks to classify and group handlers and/or logistical supporters as well. This analysis hopes to understand the overall method of attacking multiple targets and how both terrorist groups organized their handlers and cellular combat teams. By using UCINET software for structural block modeling analysis (Borgatti, Everett, & Freeman, 2002), this paper will investigate if the cellular combat teams, as well as the handler group, can be identified. Structural block modeling groups nodes in a network that share structural equivalence (Sailer, 1979). Nodes with structural equivalence are understood as nodes that not only share similar network roles, but share behavioral patterns based on those roles (Sailer, 1979). This analysis could offer new predictive approaches to studying future dark networks of this size by identifying nodes with similar roles, leading to further understandings of shared roles, such as handlers or cellular combat teams.
19 Chapter 5 Methodology
5.1 Data Collection
The Mumbai network data was collected and transformed by Azad and Gupta (2011). After collecting the data from open-source media outlets, they formatted their network data into an adjacency matrix to be inputted into UCINET. This will be the same methodology to be used when looking at the
Paris and Brussels datasets. Azad and Gupta (2011) used information from open-source news and media outlets and constructed a relational network among the LeT members that included attribute data (age, location group, betweenness centrality, degree centrality, and handler ID) (Azad & Gupta, 2011; BBC
News South Asia, 2008; Glanz, Rotella, & Sanger, 2014; Roggio, 2009) and UCINET centrality outputs
(Borgatti et al., 2002). In asocial network visualization, the ties that are shown are either defined as directed or undirected. A directed tie gives more information regarding the tie’s definition. For example, a directed tie would explain a phone call, where the caller would have a directional tie to the person being called. The person being called would not have a directed tie back to the caller. On the other hand, an undirected tie simply connects two nodes without including information regarding directionality. For the purposes of this study, undirected ties rather than the directed ties of the original work on the Mumbai network are used because directed ties offer no further insight than the undirected ties in terms of the analyses used here (Azad & Gupta, 2011). The results of the analyses would be the same if the three networks had directed or undirected ties.
The relational and attribute data of both the Paris and Brussels terrorist networks also were collected using open-source media outlets such as the BBC World News Reports and The New York
Times. Multiple sources were used to corroborate the actors and their relationships. As previously discussed, media sources differ in their reporting on terrorist events resulting in biased perspectives. To address this challenge, the research examined and analyzed data from both from the US and UK to
20 minimize these reporting biases. From this, a one-mode adjacency matrix was constructed by noting mentioned actors and developing links based on their co-occurring activities and interactions noted in the articles. Our constructed networks have nodes that represent individuals and undirected ties which are and constituted by shared communication and/or physical cooperation. If members are a part of the same combat team that attacks the same location, they will share ties. A tie also can be created if two nodes communicate with one another via face-to-face, telephone, or email contact.
5.2 Data Analysis
This research focuses on the comparison of three dark networks for the purposes of identifying similarities and differences. These network analyses hope to find ways that SNA can be used to better understand the dynamics of dark networks and spur future research. Research question 1 uses the attribute-level correlation analysis in UCINET to find the correlation between an individual’s role
(whether or not he was a handler) and their age. Research question 2 uses the KeyPlayer software package to identify key players in the network. Within each of the three networks, the identification of one key player for fragmentation (KPP-Neg) and one for utilization (KPP-Pos) was conducted. Then, each network was used to find two key players for fragmentation and two for utilization to see the comparison of eliminating or utilizing two key players in each network rather than one. The final analysis in research question3 uses UCINET’s structural block model output to examine which nodes are assigned to similar blocks in the network (Borgatti et al., 2002). This analysis groups nodes that share similar structural roles together. Based on the structural block model outputs, the created groups were analyzed to understand why these nodes were found to share similar roles.
21 Chapter 6 Results
The network structures of the Mumbai, Paris, and Brussels terrorists are depicted in Figures 6-1,
6-2, and 6-3, respectively. The shapes (i.e. defined in the keys below) depict which nodes were the handlers or logistical supporters, and which nodes comprise the attack teams and their targets. The density of a network is a comparison of the number of potential versus actual connections. The closer the number is to one, the higher the density or connectivity. The density of the Mumbai network, or proportion of ties present of all possible ties among nodes in the network, is .199. The density of the Paris network is .227 and the density of the Brussels network is .192. Each of these density values was determined using
UCINET’s density output (Borgatti et. al., 2002). The densities of these networks in each case are sufficiently similar to validate using them as a comparative study. These similar density values are a good preface to compare these networks using the following analyses.
Figure 6-1: A Depiction of the Mumbai Terrorist Network (Borgatti et al., 2002)
22
Figure 6-2: A Depiction of the Paris Terrorist Network (Borgatti et al., 2002)
Figure 6-3: A Depiction of the Brussels Terrorist Network (Borgatti et al., 2002)
6.1 Attribute-Level Correlation Analysis (RQ1)
For the Mumbai network, attribute-level correlation analysis identifies a correlation value of .890 between the terrorists’ age and role (handler vs. not a handler) with a significance of p < .01. This shows a significant and positive correlation between age and role. This finding is consistent with having older, more experienced terrorists being in command positions. The correlation value between age and role for
23 the Paris network is .517 with a marginal significance of p = .075. This shows marginal significance and positive correlation between age and role. To analyze the Brussels network, the correlation value was calculated using the “age” and “handler” attributes, rather than the “age” and “role” attributes to keep the compared variables consistent with the other two networks in the sense that there are only two outcomes of the handler variable (handler or not handler). The correlation value between age and handler for the
Brussels network had an interesting value of -.568 with a significance p = .041. For the Mumbai network, the minimum age is 21, the maximum age is 35, and the median age is 23. For the Paris network, the minimum age is 20, the maximum age is 35, and the median age is 27. For the Brussels network, the minimum age is 23, the maximum age is 35, and the median age is 29. The results of this exploration offer insight to the question: do terrorists organize their networks based on age? Do older terrorists typically assume handler roles? Although the findings above are not all statistically significant, they still offer insights to the groups’ organization. It is important to note that age is currently understood as a predictor of betweenness centrality. These results offer insight to using age to predict new variables such as potential roles in organizations. The Mumbai and Paris networks both showed a strong and positive correlation between age and role, indicating that handlers are typically older than the attackers. As with any correlation, these results do not imply that age causes one to be a handler. On the other hand, the
Brussels network showed a moderately strong and negative correlation between age and role. This finding could be due to the nature of the Brussels attacks being a reactionary operation and/or the impact of having the Paris cell destroyed. With the capture of Salah Abdeslam after the Paris attacks, the Brussels network wanted to act quickly and accelerate their operation. This may have altered the typical planning processes and role assignments that may have been different if the group had more time. Even with some mixed results, this analysis is thought to be particularly beneficial when studied alongside organizational culture and leadership analysis and offers direction for future research. Namely, it has been shown that decapitation strategies can be useful for counter terrorism efforts, given difficulty of succession within dark networks (Price, 2012).
24 6.2 Key Player Analysis (RQ2)
Identifying key players in dark networks can offer several different insights. Intelligence analysts may use key players as targets of observation to monitor their reach into the network. Law enforcement and military entities typically find key players in order to physically remove (fragmentation) them from the network. The following key player analyses are targeted at each of these perspectives. Borgatti’s
KeyPlayer software can be set to find any fixed number of key players based on their fragmentation values or their reach to other nodes. Our results are presented by using key player negative and key player positive attributes.
6.2.1 Key Player Negative
The first step of several key player analyses aimed to find one individual key player in each network based on their fragmentation and reach to other nodes. This process was applied to each of the cases.
The key player fragmentation analysis for the Paris network identified Brahim Abdeslam.
Abdeslam was a suicide bomber who detonated his vest at the Café Comptoir Voltaire; he was not a handler or logistical supporter. As a result of Brahim being a bomber who was also identified as the key player, it is understood that the network is most likely incomplete because there was probably someone else in another leadership position (Carley, 2003). This reality reflects the challenges confronted by intelligence and law enforcement, the unknown nodes of a network. It is hypothesized that the key player would be a logistical supporter or a handler, but without access to data that allowed for the construction and analysis of a perfect network, the hypothesis remains unproven.
25 When analysis is set to find only one key player whose removal will fragment the network, the results of the Mumbai analysis identified Wassi. Wassi served as the main handler operating out of
Pakistan during the attacks. He was known by the public media for his phone call transcript telling operatives to murder all of their hostages. He was a commando of LeT, implicating that he had direct ties to the leadership of LeT. Wassi personally directed the attacks on the Nariman House, Café Leopold, and the Taj Mahal Hotel. He also was in contact with Zarar and Abu Kaahfa who directed the attacks on the
Trident Hotel. His important role reflects both tactical and operational significance. In the former, removing his command and control may have rendered the attack ineffective because the attackers were not sufficiently trained to handle the complexity of the operation without guidance. Operationally, intelligence and law enforcement agencies should assess the extent to which the LeT is prepared to use external command and control for its operations and the implications for more and perhaps more lethal attacks.
Oussama Atar was found to have the highest fragmentation value in the Brussels network. Atar coordinated the Brussels attacks from Syria (Dearden, 2016) and is also the cousin of the el-Bakraoui brothers. He also radicalized and mentored the two brothers before their operations (Dearden, 2016). Atar helped coordinate the attackers at their targets. Adel Haddadi, an Algerian detained in a refugee camp at
Salzburg in Austria, reported that Atar was primarily a recruiter and organizer of events, who provided false passports, financial aid, and mobile phones for communication (BBC News Europe, 2016, Nov 8).
Table 6-1 below outlines the results of our first set of analyses. The “fragmentation after removal” numbers indicate the percentage of the network that becomes fragmented once that specific node is removed; the higher the fragmentation number, the more fragmented the network became.
26
ONE KEY PLAYER REMOVED Paris Mumbai Brussels
Brahim Wassi Oussama Atar Key Player Identified Abdeslam
Initial Fragmentation Value .000 .282 .000
Fragmentation After Removal .621 .833 .705
Table 6-1: Results for removal of one key player, based on fragmentation (Borgatti, S. P., 2003).
Next, the key player negative analysis was set to the KeyPlayer1 software’s identification setting to find two key players, rather than one, based on their fragmentation. The two key players who, if removed, most fragment the Paris network were Bilal Hadfi and Salah Abdeslam. Bilal Hadfi was a suicide bomber that detonated his vest outside the Stade de France. The removal of Hadfi would have significantly disconnected the team who attacked the theatre from the other two combat cells. Salah, the brother of Brahim, served as the driver for the attacks. He is classified as a handler/logistical supporter, which supports our hypothesis. Salah fled Paris after the attacks and was later captured during a raid of the Molenbeek area of Brussels. The capture of Salah was the event that prompted the retaliation attack on the Brussels Zaventem airport and metro station (The Independent News Europe, 2016). Thus, the removal of Salah was a catalyst rather than a disrupter but more importantly, this finding indicates a hidden network between Salah and the Brussels attack network. Knowing that Salah was a key player may have aided intelligence analysts in their understanding of these two seemingly separate events as rather two connected operations that were conducted by many shared individuals.
27 When identifying two key players, the removal of which would maximize disruption of the cell,
Wassi and Abu Kaahfa emerged in the Mumbai attacks. Wassi’s importance as the main handler explains his reappearance as a key player, but Abu Kaahfa served as one of Wassi’s main contacts for coordinating the attacks in India. Abu Kaahfa was in direct contact to Wassi, influencing the network’s flow of information. Removing him along with Wassi, the network would be most fragmented because this main line of communication would be significantly delayed, or even destroyed.
The two players that were identified for removal from the Brussels network were Oussama Atar and Salah Abdeslam. Both the Brussels output and the Paris output share Salah Abdeslam as a key player for fragmentation. This finding is interesting because Salah Abdeslam was the primary reason the attacks on the airport and the metro station were expedited shortly after the Paris attacks. Salah served as an operational supporter in both Paris and Brussels. Salah shared similar roles across multiple operations, which further demonstrates the importance of his presence in both attacks. Table 6-2 below outlines the results of these analyses.
TWO KEY PLAYERS REMOVED Paris Mumbai Brussels
1) Bilal Hadfi 1) Abu Kaahfa 1) Oussama Atar
Key Player Identified 2) Salah 2) Wassi 2) Salah Abdeslam
Abdeslam
Initial Fragmentation Value .000 .282 .000
Fragmentation After Removal .788 .872 .923
Table 6-2: Results for removal of two key players, based on fragmentation (Borgatti, S. P., 2003).
28 6.2.2 Key Player Positive
The second round of key player analyses focused on key players based on their reach values in two steps or less to represent their importance in the network for communication flow and information diffusion. A node’s reach value is a measure that illustrates how many other nodes the node of interest can connect to with one, two, or any number of “steps” away. For this analysis, the reach values were based on a node’s connectivity to other nodes in two steps or less. In other words, how many nodes can a specific node connect two by only taking a maximum of two steps? When this analysis was conducted on the Paris network, Bilal Hadfi was identified. Hadfi reaches 8 nodes in two steps or less, reaching 66.7% of the entire network. Bilal was a suicide bomber that was part of the team that attacked the Stade de
France. This result also disproves the hypothesis of identifying a handler as a key player. Even though the findings do not support the hypothesis, these results give insight to Bilal’s role in the network, making him a valuable target to spread misinformation or for monitoring and observation by intelligence analysts.
In the Mumbai network, Wassi was again identified as the key player based on his reach of 11 nodes in two steps or less. In terms of the overall hypothesis, the key player based on fragmentation and reach identified Wassi as a handler/logistical supporter. Oussama Atar was again found to be the single key player based on his reach to all other nodes. Atar was able to reach 9 nodes in two steps or less, reaching
69.2% of the network. Atar was also a handler for the Brussels attacks, which supports the initial hypothesis. Table 6-3 below outlines the results for this analysis.
29
ONE KEY PLAYER MONITORED Paris Mumbai Brussels
Key Player Identified Bilal Hadfi Wassi Oussama Atar
Nodes Reached in <2 Steps 8 11 9
Percent of Network Reached 66.7% 84.6% 69.2%
Table 6-3: Results for monitoring of one key player, based on reach (Borgatti, S. P., 2003).
The final step in the key player analyses was to find two key players based on their reach values for each network. When looking for key players based on their reach, M al Mahmod and Salah Abdeslam were identified as the two key players in Paris. Mahmod was a part of the team that attacked the Stade de France where he detonated his vest. Salah’s importance is highlighted earlier from his fragmentation impact. However, the key player positive analysis presented that Salah would also have been an ideal candidate for monitoring, which is intuitive because of his importance to the hidden Brussels network.
Being identified as a key player for both positive and negative analyses is important to note for resource allocation for both intelligence agencies and law enforcement entities.
The same analysis was also applied to the Mumbai network. The two key players that were identified for their reach to the rest of the network were Wassi and Ismail Khan. Similar to the previous analysis that found only one key player, Wassi was the main handler operating out of Pakistan. Ismail
Khan was later found to be the attack’s operational leader (McElroy, 2008), explaining his identification as a key player. Both of these individuals would be ideal candidates for monitoring because of their leadership roles; Ismail Khan’s role as the leader of the gunmen, if monitored, would produce valuable
30 intelligence for our country’s intelligence agencies. It is important to note that KeyPlayer software does not allow the user to specify an individual to find.
Oussama Atar was once again found to be a key player for the Brussels network. The second player identified based on their reach was Najim Laachraoui. Laachraoui was a suicide bomber that attacked the airport (BBC News Europe, 2016, April 9). Later Najim was identified as a close accomplice to Salah Abdeslam, confirming his importance as a key player (BBC News Europe, 2016, April 9).
Finally, Laachraoui was identified as a bomb maker, further establishing his key player role. These findings choosing Najim Laachraoui as a candidate for monitoring, more information about not only details of the attacks but also of Salah Abdeslam’s role in these two networks could have been found in a preventative fashion rather than a reflective one. Table 6-4 below outlines the results of these analyses.
TWO KEY PLAYERS MONITORED Paris Mumbai Brussels
1) M al Mahmod 1) Ismail Khan 1) Oussama Atar Key Player Identified 2) Salah Abdeslam 2) Wassi 2) Najim L.
Nodes Reached in <2 Steps 12 13 13
Percent of Network Reached 100% 100% 100%
Table 6-4: Results for monitoring two key players, based on reach (Borgatti, S. P., 2003).
6.3 Structural Blockmodeling (RQ3)
Structural block modeling presents potentially the most meaningful results. Each of the networks’ cellular combat teams was nearly perfectly depicted by the block models. In the Mumbai network, Wassi was the only node that was not assigned to the same block as the rest of the handlers. This can be
31 explained by his degree centrality; his many connections to the rest of the network make him difficult to classify in terms of block assignments. Wassi was given an exclusive block being a handler, with direct connections to LeT leadership, because he directed and co-directed many of the attacks. Table 6-5 below outlines the results of the block modeling results for the Mumbai network.
Block Number Assigned Block Members Locations
1 Abu Kaahfa (H) Zarar (H) ---
2 Javed (A) Abu Shoaib (A) Taj Mahal Hotel
3 Abdul Rehman (A) Fahadullah (A) Oberion Trident Hotel
4 Ajmal Amir Kasab (A) Ismail Khan (A) CST
5 Wassi (H) ------
6 Baba Imran (A) Nasir (A) Nariman House
7 Hafiz Arshad (A) Abu Umer (A) Leopold Cafe
Table 6-5: Block model output for the Mumbai network. Handler (H); Attacker (A).
In the Paris network, the cellular combat teams were perfectly represented with the exception of
Salah Abdeslam. Salah served as the driver, driving each combat team to their assigned targets
(Parlapiano et al., 2016). In the constructed network, he shared a tie with his brother Brahim. Salah, the only survivor of the attacks, was assigned to his brother’s combat team according to the block model.
This single difference between the block model and the network attributes did not discount our hypothesis in RQ3. Structural block models served as a nearly perfect predictor for identifying each network’s combat teams and handlers. This analysis should be explored further in future work to continue to test its
32 findings. For example, if a network was created with unknown attribute knowledge regarding possible attack locations, this method could help analysts potentially identify cellular combat teams. By understanding which nodes are structurally equivalent, intelligence analysts can better study those individuals’ behaviors and network positions. With this knowledge, analysts can better understand their overall network of interest’s information flow and its organization based on roles and positions. Table 6-
6 below displays the structural block model results for the Paris network.
Block Assigned Block Members Locations Number
Brahim Abdeslam Abdelhamid Abaaoud Salah Abdeslam Chakib Akrouh Bataclan Theatre 1 (A) (A) (H) (A)
2 Mohamed Abrini (H) Mohamed Belkaid (H) ------
Bilal Hadfi (A) M al Mahmod (A) Ahmad al- --- Stade de France 3 Mohammed (A)
Samy Amimour (A) Foued Mohammed- Ismail Omar --- Café/Bar 4 Aggad (A) Mostefai (A)
Table 6-6: Block Model Output for Paris Network. Handler (H); Attacker (A).
The block model output for the Brussels network also supports RQ3. Each of the attack groups were modeled appropriately, while the handlers and operational supporters also were accurately organized. There was one exception in Oussama Atar, who was grouped with the attack metro station attack group. Oussama Atar was previously classified as a key player for both fragmentation and diffusion. This finding could be due to the fact that Oussama Atar was in direct contact with individuals from both attack teams. This finding could also be due to the fact that the attack was reactionary and rushed. The Brussels network is unique from the other networks in the sense that some nodes were
33 assigned either a role as a “handler” or an “operational supporter.” To keep the definition of a handler consistent with the Paris and Mumbai networks, the nodes assigned as a “handler” were those who operated from behind closed curtains in Syria or other countries separate from the attacks in Brussels.
Those nodes who were assigned as an “operational supporter” were those who had direct influence on the operation’s initial stages but did not physically attack a target or operate remotely. For example, Oussama
Atar is a handler because he operated out of Syria and conducted the attacks remotely, while Salah was found to share a safe house in Schaerbeek with Najim Laachraoui (BBC News Europe, 2016, March 26).
Najim was a long-time friend of Salah and helped him travel throughout Europe between the Paris and
Brussels attacks (BBC News Europe, 2016, March 26).
Block Assigned Block Members Locations Number
Ibrahim el-Bakraoui (A) Mohamed Abrini (A) Najim Oussama Atar Maelbeek Metro 1 Laachraoui (A) (H) Station
Mehdi Nemmouche Abdelhamid Abaaoud Mohamed Abu ---
2 (O) (O) Belkaid (H) Souleymane al-
Faransi (H)
Osama Krayem (A) Khalid el-Bakraoui (A) ------Zaventem
3 International
Airport
Salah Abdeslam (O) Ali Oulkadi (H) Brahim ------4 Abdeslam (H)
Table 6-7: Block Model Output for Brussels Network. Handler (H); Operational Support (O); Attacker (A).
34 Chapter 7 Discussion and Conclusion
This research used the preliminary analysis of the Mumbai network by Azad and Gupta (2011), in combination with our construction of the Paris and Brussels networks, to explore new ways to retrospectively compare and analyze terror networks. This retrospective comparative analysis offered insight into attribute-based hypothesis testing, key player analysis, and structural block modeling as tools to better understand structural patterns in social networks of terrorists. While previous research has used centrality as a tool to identify key players, the most central nodes are not often logical cut points to disrupt or diffuse information throughout a network. Additionally, the research attempted to connect social network measures to node-level attributes of actors in the network as a method to understand and compare terrorist groups. The first analysis found that the correlation between role and age was marginally significant, strong, but not always positive, predictor for a terrorist’s position within a dark network. This opens up an avenue for future work to see if age can serve as a predictor of a terrorist’s organizational role in emerging networks with the assessment that Brussels’ findings were due to its reactionary operation. The second analysis identified that key players in each network, whether positive or negative, were handlers/logistical supporters or attackers with direct access to the supporting cast. The third analysis found that structural block modeling depicts cellular combat teams with high precision. For each of these findings, future research could seek to apply these analyses to other dark networks as they develop. Continuing these analyses on future networks could result in similar or new findings that can strengthen global security and counter-terrorism assets.
Future research could also take a deeper look into Abdelhamid Abaaoud’s role in the Paris attacks. He was given tactical planning authority with some operational level aspects, whereas in Mumbai the handlers expressed extremely tactical authority. In Mumbai, the handlers told the attackers exactly
35 when to conduct the attacks; this did not happen in the Paris and Brussels attacks. This could speak to a slightly differing role for Abaaoud, which can be explored in the future.
While this research offers an approach to terrorism research that has not been seen yet (i.e. comparative social network analysis), it is acknowledged that the research contains limitations. For instance, all of the networks are small. Small networks can sometimes offer difficulties in SNA applications (Katz et al., 2004), but the analytic approaches are appropriate for this size data set. The networks are also most likely incomplete due to the nature of dark networks (Carley, 2003). Dark networks are almost always incomplete and imperfect due to a lack of knowledge or misinformation. It is known from recent interrogations of Omar Sheik, an al Qaeda affiliate that organizations now offer training to hide from adversarial surveillance, portray false information and deceit, and secure communication channels (Jessee, 2006). The issue of generalizing the results to other terrorist organizations is also identified. For example, our results for RQ1 may not extend to all terrorist organizations’ and their unique organizational patterns. This research proposes the formation of a social network analysis terrorism database, which is updated as new information arises, to assist in the challenges of constructing dark networks.
Understanding dark networks is crucial to global security and should continue to be of utmost importance in the cross-disciplinary research fields. SNA offers a wide range of possibilities when analyzing dark networks. This research utilized node-level correlation analysis, key player analysis, and structural block modeling to offer comparative analysis of the Mumbai, Paris, and Brussels networks and found that they offered valuable insight to the operational dynamics and tendencies of each attack. The node-level correlation analysis, which indicated a moderate-to-strong relationship between age and network role, highlights the importance of age within dark networks and can be potentially used as a counterterrorism tool by noting new recruits that are likely to be attackers. The key player analyses
36 presented here partially support the hypothesis that key players would be identified as handlers or logistical supporters. Nonetheless, the key player analyses supported qualitative explanations of these individuals’ roles in their respective networks. The structural block modeling offered insight to the physical structuring of each network and identifying which nodes could be predicted as sharing similar roles and positions. This is especially important when looking at the identification of cellular combat teams, allowing for possible predictive analyses to be done by intelligence analysts.
37 References
Austin, Henry. (2016, March 23). Brussels Attacks: Timeline of the Events in the Belgian Capital. NBC
News. http://www.nbcnews.com/storyline/brussels-attacks/brussels-attacks-timeline-events-
belgian-capital-n544221
Azad, S., & Gupta, A. (2011). A quantitative assessment on 26/11 Mumbai attack using social network
analysis. Journal of Terrorism Research, 2(2). p1-11.
Bader, D. A., Kintali, S., Madduri, K., & Mihail, M. (2007). Approximating betweenness centrality. Paper
presented at the International Workshop on Algorithms and Models for the Web-Graph. p1-5
Bavelas, A. (1948). A mathematical model for group structures. Human organization, 7(3), p16-30.
BBC News Europe. (2015, November 19). Paris attacks: ‘Ringleader’ Abdelhamid Abaaoud killed in
raid. BBC. http://www.bbc.com/news/world-europe-34867615
BBC News Europe. (2015, December 9). Paris attacks: What happened on the night. BBC.
http://www.bbc.com/news/world-europe-34818994
BBC News Europe. (2016, March 26). Brussels attacks: Paris attack suspect Abdeslam goes silent. BBC.
http://www.bbc.com/news/world-europe-35901935
BBC News Europe. (2016, April 9). Brussels explosions: What we know about airport and metro attacks.
BBC. http://www.bbc.com/news/world-europe-35869985
BBC News Europe. (2016, April 27). Paris attacks: Who were the attackers? BBC.
http://www.bbc.com/news/world-europe-34832512
BBC News Europe. (2016, November 8). Belgian Jihadist Atar ‘co-ordinated’ Paris and Brussels attacks.
BBC. http://www.bbc.com/news/world-europe-37906961
BBC News South Asia. (2008, November 30). How Mumbai attacks unfolded. BBC.
http://news.bbc.co.uk/2/hi/south_asia/7757500.stm
38 Belasco, A. (2009). Cost of Iraq, Afghanistan, and Other Global War on Terror Operations Since 9/11:
DIANE Publishing. https://fas.org/sgp/crs/natsec/RL33110.pdf.
Belgium Reveals Calls between Abdeslam and Detained Paris Attack Suspect. (2017, January 31). Latin
American Herald Tribune.
http://www.laht.com/article.asp?CategoryId=12395&ArticleId=2402380
Borgatti, S. P. (2003). KeyPlayer 1.45. Lexington, KY: Analytic Technologies.
Borgatti, S. P. (2005). Centrality and network flow. Social networks, 27(1), 55-71.
Borgatti, S. P. (2006). Identifying sets of key players in a social network. Computational & Mathematical
Organization Theory, 12(1), p21-34.
Borgatti, S. P., Everett, M. G., & Freeman, L. C. (2002). Ucinet for Windows: Software for social
network analysis.
Brinton Milward, H., & Raab, J. (2006). Dark networks as organizational problems: Elements of a theory
1. International Public Management Journal, 9(3), p333-360.
Burgess, M. (2003). A brief history of terrorism. Center for Defense Information.
https://web.archive.org/web/20120511140810/http://cdi.org/friendlyversion/printversion.cfm?doc
umentID=1502
Callimachi, Rukmini. (2016, November 22). ISIS Operative Suspected in Paris and Brussels Attacks is
Identified. The New York Times. https://www.nytimes.com/2016/11/22/world/europe/isis-paris-
brussels-attacks.html
Callimachi, Rukmini. (2017, February 4). Not Lone Wolves’ After All: How ISIS Guides World’s Terror
Plots From Afar. The New York Times. https://www.nytimes.com/2017/02/04/world/asia/isis-
messaging-app-terror-plot.html
Carley, K. M. (2003). Dynamic Network Analysis. Summary of the NRC workshop on Social Network
Modeling and Analysis. p96-105.
39 Clarke, Sean. (2016, March 22). Timeline of the Brussels attacks. The Guardian.
https://www.theguardian.com/world/ng-interactive/2016/mar/22/where-the-brussels-attackers-
struck
Cunningham, D., Everton, S., & Murphy, P. (2016). Understanding Dark Networks: A Strategic
Framework for the Use of Social Network Analysis: Rowman & Littlefield.p47,329.
Dearden, Lizzie. (2016, November 8). Oussama Atar: Belgian Isis Fighter Hunted as Possible
Mastermind behind Paris and Brussels attacks. Independent.
http://www.independent.co.uk/news/world/europe/oussama-atar-isis-paris-brussels-attacks-
mastermind-coordinator-abou-ahmad-bakraoui-brothers-syria-a7404631.html
Forster, Peter & Thomas Hader. (2016, July 18). Combating Domestic Terrorism: Observations from
Brussels and San Bernardino. Small Wars Journal.
http://smallwarsjournal.com/jrnl/art/combating-domestic-terrorism-observations-from-brussels-
and-san-bernardino
Fotion, N., Kashnikov, B., & Lekea, J. K. (2007). EPZ Terrorism: The New World Disorder: A&C Black.
p26-62.
Freeman, L. C. (1977). A set of measures of centrality based on betweenness. Sociometry, p35-41.
Freeman, L. C. (1978). Centrality in social networks conceptual clarification. Social networks, 1(3), p215-
239.
Gardham, Duncan. (2016, December 7). The ‘Man in the Hat’ Spills Terror Gang’s Secrets. NBC News.
http://www.nbcnews.com/storyline/brussels-attacks/man-hat-spills-terror-gang-s-secrets-
n693046
Glanz, J., Rotella, S., & Sanger, D. E. (2014, December 21). In 2008 Mumbai Attacks, Piles of Spy Data,
but an Uncompleted Puzzle. New York Times.
https://www.nytimes.com/2014/12/22/world/asia/in-2008-mumbai-attacks-piles-of-spy-data-but-
an-uncompleted-puzzle.html
40 Granovetter, M. S. (1973). The strength of weak ties. American journal of sociology, 1360-1380.
IARPA Broad Agency Announcement (2016). Crowdsourcing evidence, argumentation, thinking and
evaluation (CREATE). IARPA-BAA-15-11.
Jessee, D. D. (2006). Tactical means, strategic ends: al Qaeda's use of denial and deception. Terrorism
and Political Violence, 18(3), p367-388.
Katz, N., Lazer, D., Arrow, H., & Contractor, N. (2004). Network theory and small groups. Small group
research, 35(3), p307-332.
LaFree, G., & Dugan, L. (2007). Introducing the global terrorism database. Terrorism and Political
Violence, 19(2), p181-204.
Lankford, A. (2013). A comparative analysis of suicide terrorists and rampage, workplace, and school
shooters in the United States from 1990 to 2010. Homicide Studies, 17(3), 255-274.
McElroy, D. (2008, December 9). Mumbai attacks: India 'names Pakistani gunmen'. The Telegraph.
http://www.telegraph.co.uk/news/worldnews/asia/india/3691620/Mumbai-attacks-India-names-
Pakistani-gunmen.html
Miller, C. (2015, November 23). At least two Paris suicide bombers entered Greece posing as refugees.
Mashable. http://mashable.com/2015/11/23/paris-attackers-posed-as-refugees/#UXp7X_pmX8qC
Nossiter, A., Breeden, A., & Bennhold, K. (2015, November 14). Three Teams of Coordinated Attackers
Carried Out Assault on Paris, Officials Say; Hollande Blames ISIS. New York Times.
https://www.nytimes.com/2015/11/15/world/europe/paris-terrorist-attacks.html
Ortiz-Arroyo, D., & Hussain, D. A. (2008). An information theory approach to identify sets of key
players Intelligence and Security Informatics Springer. p15-26.
Papacharissi, Z., & de Fatima Oliveira, M. (2008). News frames terrorism: A comparative analysis of
frames employed in terrorism coverage in US and UK newspapers. The International Journal of
Press/Politics, 13(1), p52-74.
41 Parlapiano, A., Andrews, W., Park, H., Buchanan, L., & Almukhtar, S. (2016, March 18). Unraveling the
Connections Among the Paris Attackers. New York Times.
https://www.nytimes.com/interactive/2015/11/15/world/europe/manhunt-for-paris-
attackers.html?_r=0
Participation of Children and Teenagers in Terrorist Activity during the Al-Aqsa Intifada. (2003, January
30). Israel Ministry of Foreign Affairs. http://mfa.gov.il/MFA/MFA-
Archive/2003/Pages/Participation%20of%20Children%20and%20Teenagers%20in%20Terrori.as
px
Perliger, Arie and Ami Pedahzur. (2011). Social Network Analysis in the Study of Terrorism and Political
Violence. Cambridge University Press. https://www.cambridge.org/core/services/aop-cambridge-
core/content/view/6F15C96DA798447F89564011202F2E75/S1049096510001848a.pdf/div-
class-title-social-network-analysis-in-the-study-of-terrorism-and-political-violence-div.pdf
Permanent Select Committee on Intelligence. (1996). IC21 The Intelligence Community in the 21st
Century - Staff Study Permanent Select Committee on Intelligence. p4-7.
Price, B. C. (2012). Targeting top terrorists: How leadership decapitation contributes to
counterterrorism. International Security, 36(4), p9-46.
Rabasa, A., Blackwill, R.D., Chalk, P. Cragin, K., Fair, C.C., Jackson, B.A, Jenkins, B.M., Jones, S.G.,
Shestak, N., Tellis, A.J, (2009). The Lessons of Mumbai. RAND Corporation. p3-4.
Ressler, S. (2006). Social network analysis as an approach to combat terrorism: Past, present, and future
research. Homeland Security Affairs, 2(2). p1-11.
Roggio, B. (2009, January 7). Mumbai handlers in Pakistan cheer after ordering murders over phone. The
Long War Journal. http://www.longwarjournal.org/archives/2009/01/mumbai_handlers_in_p.php
Sailer, L. D. (1979). Structural equivalence: Meaning and definition, computation and application. Social
networks, 1(1), p73-90.
42 Sandhu, S. (2015, December 9). Paris attacks: Father of Bataclan killer says he ‘would have killed him if
he had known what he was going to do’. The Independent.
http://www.independent.co.uk/news/world/europe/paris-attacks-father-of-bataclan-killer-says-he-
would-have-killed-him-if-he-had-known-what-he-was-a6766626.html
The Independent News Europe. (2016, March 22). Brussels attacks come just four days after capture of
Paris terror suspect Salah Abdeslam. The Independent. http://www.independent.ie/world-
news/europe/brussels-attacks-come-just-four-days-after-capture-of-paris-terror-suspect-salah-
abdeslam-34561104.html
TTU Online. (2016, April 15). Abou Souleiman: the French Emir of Daech. TTU. http://www.ttu.fr/abou-
souleiman-lemir-francais-de-daech/
Wagner, Meg. (2016, March 22). Dozens Killed in ISIS Attacks in Brussels Airport, Subway. The New
York Daily News. http://www.nydailynews.com/news/world/brussels-airport-rocked-apparent-
explosion-article-1.2572746
Worth, Katie. (2016, July 14). Lone Wolf Attacks Are Becoming More Common – And More Deadly.
PBS Frontline. http://www.pbs.org/wgbh/frontline/article/lone-wolf-attacks-are-becoming-more-
common-and-more-deadly/