CONNECTIONS 24(3): 43-52 ©20021NSNA© 2002 INSNA Mapping Networks of Terrorist CellsCells Valdis E. Krebs orgnet.cornorgnet.com This paper looks atat thethe difficultydifficulty inin mappingmapping covertcovert networks. networks. AnalyzingAnalyzing networks after an event isis fairly easy for prosecution purposes.purposes. Mapping covertcovert networks to prevent criminal activity is much more difficult.difficult. We examine the network surrounding thethe tragic events of September 11th,11 th, 2001. ThroughThrough public datadata wewe areare able to map a portionportion of the network centeredcentered around thethe 1919 dead hijackers. ThisThis mapmap givesgives us some insight into the terrorist organization, yet itit isis incomplete. SuggestionsSuggestions for further work andand researchresearch are offered. INTRODUCTIONINTRODUCTION AND BACKGROUND We were all shockedshocked by the tragictragic eventsevents ofof SeptemberSeptember 11,11, 200 2001. 1. InIn thethe nonnon-stop-stop stream ofof news and analysis oneone phrase waswas constantlyconstantly repeated repeated and and usedused inin many contexts - "terrorist"terrorist network."network." Everyone talked about this concept, and described it as amorphous, invisible,invisible, resilient, dispersed and other termsterms thatthat made made it it difficultdifficult toto visualizevisualize what this structure reallyreally looks like. I set outout to map this network of of terrorist cells cells thatthat had had so so affectedaffected allall of our lives. I would be mapping a 'project team' -- muchmuch like like thethe legal,legal, overt groups I had mapped inin countlesscountless consulting assignments. BothBoth overtovert andand covertcovert projectproject teamsteams have tasks to complete, informationinformation to share,share, funding to obtainobtain andand administer,administer, schedulesschedules to meet,meet, workwork toto coordinate,coordinate, andand objectivesobjectives to accomplish.accomplish. HowHow a a normalnonnal project project team team does does all all of of that that is is easyeasy to mapmap andand measure measure using using several several setset of ties - task, resource, strategystrategy andand expertise expertise links.links. II was was surprised atat thethe difficultydifficulty of this particular effort - bothboth in in datadata definitiondefinition andand discovery.discovery. MyMydata data sources were publiclypublicly releasedreleased informationinformation reported in in major major newspapers newspapers such such as as the New York Times, the Wall Street Journal, the Washington Post, andand thethe LosLos AngelesAngeles Times. AsAs I monitored thethe investigation,investigation, itit waswas apparentapparent thatthat thethe investigators investigators wouldwould notnot bebe releasingreleasing allall ACLURM002810 4444 MappingMapping Networks of Terrorist CellsCells // Krebs pertinent network/relationship network/relationship information information and and actually actually may may be be releasingreleasing misinformation to fool thethe enemy. II soonsoon realizedrealized that the data was not going to be as complete and accurate as I had grown accustomed toto inin mappingmapping andand measuringmeasuring organizationalorganizational networks.networks. For guidance I turnedturned to previous work by social networknetwork theoriststheorists who had studied covert, secret, oror illegalillegal networks.networks. II found found threethree excellentexcellent papers papers that that formedformed aa working working foundationfoundation for the knowledge I wouldwould use toto pursuepursue this project. Malcolm Sparrow (Sparrow (Sparrow 1991) 1991) has has an an excellentexcellent overview of thethe application of social network analysis toto criminalcriminal activity.activity. Sparrow describes three problems of criminal network analysis that that II soon soon encountered. encountered. 1. Incompleteness - thethe inevitabilityinevitability of missing nodes and linkslinks thatthat thethe investigatorsinvestigators will not uncover. 2. Fuzzy boundariesboundaries - the difficulty in deciding whowho toto includeinclude andand whowho not to include. 3. Dynamic - these networks are not static, they are always changing. changing. Instead ofoflooking looking at the presence or absence of a tie betweenbetween twotwo individuals,individuals, Sparrow suggests looking at the waxing and waning strength of a tietie dependingdepending uponupon the time and the task at hand.hand. Wayne Baker and Robert Faulkner (Baker(Baker and Faulkner 1993) 1993}suggestlookin suggest lookinggatarchival at archival data to derive relationship data. TheThe data data they they used used to to analyze analyze illegal price-fixingprice-fixing networksnetworks were mostlymostly courtcourt docu­docu- ments and sworn testimony. This data inclincluded uded accoaccounts unts ofobserved observed interpersonalinterpersonal relationships from various witnesses. The hijackers of September 11th 11 th were not directly observed by others in great detail. Bonnie Erickson (Erickson 1981) revealsreveals thethe importanceimportance of trusted priorprior contactscontacts forfor thethe effective effective functioning of a secret society.society. The 1919 hijackers appeared to have come from a network that had formed while they were completingcompleting terroristterrorist trainingtraining in Afghanistan. Many were school chums from many years ago, somesome had lived togethertogether forfor years,years, andand othersothers were relatedrelated byby kinshipkinship ties.ties. Deep trusted ties, ties, thatthat were not easilyeasily visible toto outsiders,outsiders, wovewove this this terror terror networknetwork together.together. Data Gathering Within oneone week of the the attack,attack, infonnationinformation from the investigation started to become public. We soon knew there were 19 hijackers,hijackers, whichwhich planes theythey werewere on, on, and and whichwhich nation'snation's passports they had used toto get intointo thethe country.country. As more informationinformation about about the the hijackers' hijackers' past past was was uncovered II decided to map linkslinks of three strengths (and corresponding thicknesses). thicknesses). TheThe tie tie strength strength would would largely largely bebe governed by the amount ofof time together by a pair of terrorists. ThoseThose living living togethertogether oror attendingattending thethe samesame schoolschool or the same classes/training would have the strongest ties. Those travellingtravelling togethertogether andand partici­partici- patinginpatinginmeetings meetings togetherwould togetherwould have haveties ties ofofmoderatemoderate strength strength and and medium medium thickness. thickness. Finally,Finally, those who were recorded asas having a financialfinancial transactiontransaction together, or an occasional meeting, and no other ties,ties, I sortedsorted intointo thethe dormantdormant tie category-category- theytheywould would rarelyrarelyinteract. interact. TheseThese relationships relationships were were shown with the thinnest links in the network. II started my mapping project project upon upon seeing seeing the the matrix matrix in in Figure Figure 1 1 on on the the web web sitesite of the Sydney MorningMorning Herald (AU) (AU) (Sydney(Sydney Morning Morning Herald, Herald, 2001). 2001). This This was was the the first first attempt attempt I Ihad hadseentovisuallyorganize seen to visually organize thethe datadata thatthat was was graduallygradually becomingbecoming available available twotwo weeks after the tragedy. SoonSoon after the matrix in Figure 1 waswas published,published, the WashingtonWashington Post releasedreleased a more detailed matrix ofof how the hijackers had spent their time inin thethe USAUSA andand with with whom whom (Washington(Washington Post,Post, 2001).2001). The mostmost detaileddetailed documentdocument of of the the hijackers hijackers relationships relationships and and activity activity was was released released in in DecemberDecember 2001 2001 inin thethe IndictmentIndictment of of Zacarias Zacarias Moussaoui (Department ofJustice,ofJustice, 2001).2001). ACLURM002811 Mapping Networks of Terrorist Cells // Krebs 45 THE HIJACKERS .... AND HOW THEY WEREWERE CONNECTED Am1!riclll1 Afrfllles 1I UnitedAir#nll$175Unitednirlines 175 AttendedAttended same I Known to be U$t boo Crashed !oto wre: (nmth) I KOOYmi!) " i Last known t«lImeal(flf~technical college I together in weekwetll lIdll"$$addreSS •MoI1am~Atta~.; ... before attatksattacks M1Imiwrq,Harithout GtrmaJl¥Germany n~I!YWll!i!1, florida ..... t~~~}(~~~: MobilmetlAtiatoned Atte i !>tllv~d tG~et1m' Marwan IIHllehll1al•Shehhi MilManNoreen al-Shehhial'Slwhlli I l~ II f1l1rldi! W<llttll M.I. A!:shear!Alshehri Wa!ee1:! M:Alsll~M;:. li/KIziad Jarrllhjarrah ! mll~ Wait Aishatuihri ···~=~C~JJ)ilo;;,>/ i !.ll)llamedAUaMohamed Atta li/KI Jarrah Marna al-SlIehhi Hani MaOjOiif TilOliTook ftiiJlltflight (lasses classes IMilrwan ilrslwllhi .•. willI AISliahri ; >1 t0gelhertogether lmMfl@GAttended 11a gymlJV1II U11l®r cill~1i .··~~~&in<ltl~al~~i····· Pi!otPilot Sdtimlsschools 1 inin lIIarylam!Maryland In Fl<frlda inif, t!;;rridaFlorida I (Sept(S;ejlt Z·¢H.2-6). MoflairiiidAU.atried Atta MoflamedAttaMohamed Atte 1I alsoail4 seenSll1m. diningdill/iiI} fayezAbl'lledayez Ahmed MarnanMarkvan al'Sbehnial-Shehhi ti)lI~tll~ttogether Ahmedhated AlghanoliAkjflal!l1ii KOOlfi1d ahl«io:lhilfal-idharM Moflaldbald AJsbehrlAlshehri Pilot tcl!oo!sschools I I Miljedt.lO~Waled Mooed lIbalidalid