In space there is no definite location, only in relation to everyone else in the space — you are located by who you are connected to.

September 11, 2001 event - Uncloaking Terrorist Networks

Source: Valdis Krebs (http://orgnet.com)

Data Gathering – Within one week of the attack, information from the investigation started to become public. We soon knew there were 19 hijackers, which planes they were on, and which nation’s passports they had used to get into America. As more information about the hijackers’ past was uncovered the investigators decided to map links of three strengths (and corresponding thickness). The tie strength would largely be governed by the amount of time together by a pair of terrorists. Those living together or attending the same school or the same classes/training would have the strongest ties.

Those traveling together and participating in meetings together would have ties of moderate strength and medium thickness. Finally, those who were recorded as having a single transaction together, or an occasional meeting, and no other ties, they classified as weak ties that were shown with the thinnest links in the network.

The investigators started their mapping project upon seeing several summaries of data about the hijackers in major newspapers (Sydney Morning Herald, 2001; Washington Post, 2001). These data collections contained information about the nodes/hijackers and their links/relationships.

From two to six weeks after the event, it appeared that a new relationship or node was added to the network on a daily basis. Several false stories appeared about a cell in Detroit. These stories, originally reported with great fanfare, were proven false within one week. This made the investigators very cautious about adding a link or a node to the network.

The network was created iteratively as data became available. Everyday the investigators checked the major news sources for updated information. Figure “1″ shows their computer screen during this process. The browser window shows the news story, the other window shows the network mapping and measuring software. They would add nodes and links to the map as they read the news accounts. Figure “1″ shows a link being added between one of the hijackers and an accomplice.

Figure 1

By the middle of October enough data was available to start seeing patterns in the hijacker network. Initially, the investigators examined the prior trusted contacts – those ties formed long ago through living and learning together. The network self-organized (via a network layout algorithm) into the shape of a serpent – how appropriate, they thought.

Figure 2

The investigators were amazed at how sparse the network was and how distant many of the hijackers on the same team were from each other. Many pairs of team members were beyond the horizon of observability from each other – many on the same flight were more than two steps away from each other. A strategy for keeping cell members distant from each other, and from other cells, minimizes damage to the network if a cell member is captured or otherwise compromised. Usama bin Laden even described this plan in his infamous videotape, which was found in Afghanistan. In the transcript (U.S. Department of Defense, 2001) Usama bin Laden mentions: “Those who were trained to fly didn’t know the others. One group of people did not know the other group.”

The network metrics for the network in Figure “2″ are found in Table “1″. For a small network of less than 20 nodes, we see a long average path length of 4.75 steps. Several of the hijackers are separated by more than 6 steps. From this metric and bin Laden’s comments above we see that covert networks trade efficiency for secrecy.

Table 1: Small-World Network Metrics

	Clustering Coefficient	Average Path Length
Contacts	0.41	4.75
Contacts + Shortcuts	0.42	2.79

Yet, work has to be done, plans have to be executed. How does a covert network accomplish its goals? Through the judicious use of transitory shortcuts in the network. Meetings were held that connected distant parts of the network to coordinate tasks and report progress. After coordination was accomplished, the cross-ties went dormant. One well documented meeting of the hijacker network took place in Las Vegas. The ties from this and other meetings are shown in gold in Figure “3″.

Figure 3

Six (6) shortcuts were added to the network temporarily in order to collaborate and coordinate. These shortcuts reduced the average path length in the network by over 40% thus improving the information flow in the network – see Table “1″. When the network is brought closer together by these shortcuts, all of the pilots ended up in a small clique – the perfect structure to efficiently coordinate tasks and activities. There is a constant dynamic between keeping the network hidden and actively using it to accomplish objectives.

The 19 hijackers did not work alone. They had other accomplices that did not get on the planes. These co-conspirators were conduits for money and also provided needed skills and knowledge. Figure “4″ shows the hijackers and their network neighborhood – their direct and indirect associates.

Figure “4″

After one month of investigation it was ‘common knowledge’ that Mohamed Atta was the ring leader of this conspiracy. Again, bin Laden verified Atta’s leadership role in the video tape (U.S. Department of Defense, 2001). Looking at the diagram he has the most connections. In Table “2″ we see that Atta scores the highest on all network centrality metrics – Degrees, Closeness, and Betweenness.

The network metric Degrees reveals Atta’s activity in the network. Closeness measures his ability to access others in the network and monitor what is happening. Betweenness shows his control over the flow in the network – he plays the role of a broker in the network. These metrics support his leader status.

Table 2: Hijackers Network Neighborhood

Degrees * possible false ID		Betweenness		Closeness
0.361	Mohamed Atta	0.588	Mohamed Atta	0.587	Mohamed Atta
0.295	Marwan Al-Shehhi	0.252	Essid Sami Ben Khemais	0.466	Marwan Al-Shehhi
0.213	Hani Hanjour	0.232	Zacarias Moussaoui	0.445	Hani Hanjour
0.180	Essid Sami Ben Khemais	0.154	Nawaf Alhazmi	0.442	Nawaf Alhazmi
0.180	Nawaf Alhazmi	0.126	Hani Hanjour	0.436	Ramzi Bin al-Shibh
0.164	Ramzi Bin al-Shibh	0.105	Djamal Beghal	0.436	Zacarias Moussaoui
0.164	Ziad Jarrah	0.088	Marwan Al-Shehhi	0.433	Essid Sami Ben Khemais
0.148	Abdul Aziz Al-Omari*	0.050	Satam Suqami	0.424	Abdul Aziz Al-Omari*
0.131	Djamal Beghal	0.048	Ramzi Bin al-Shibh	0.424	Ziad Jarrah
0.131	Fayez Ahmed	0.043	Abu Qatada	0.409	Imad Eddin Barakat Yarkas
0.131	Salem Alhazmi*	0.034	Tarek Maaroufi	0.409	Satam Suqami
0.131	Satam Suqami	0.033	Mamoun Darkazanli	0.407	Fayez Ahmed
0.131	Zacarias Moussaoui	0.029	Imad Eddin Barakat Yarkas	0.404	Lotfi Raissi
0.115	Hamza Alghamdi	0.026	Fayez Ahmed	0.401	Wail Alshehri
0.115	Said Bahaji	0.023	Abdul Aziz Al-Omari*	0.399	Ahmed Al Haznawi
0.098	Khalid Al-Mihdhar	0.022	Hamza Alghamdi	0.399	Said Bahaji
0.098	Saeed Alghamdi*	0.017	Ziad Jarrah	0.391	Agus Budiman
0.098	Tarek Maaroufi	0.015	Ahmed Al Haznawi	0.391	Zakariya Essabar
0.098	Wail Alshehri	0.013	Salem Alhazmi*	0.389	Mamoun Darkazanli
0.098	Wail Alshehri	0.013	Salem Alhazmi*	0.389	Mamoun Darkazanli
0.098	Waleed Alshehri	0.012	Lotfi Raissi	0.389	Mounir El Motassadeq
0.082	Abu Qatada	0.012	Saeed Alghamdi*	0.389	Mustafa Ahmed al-Hisawi
0.082	Agus Budiman	0.011	Agus Budiman	0.372	Abdelghani Mzoudi
0.082	Ahmed Alghamdi	0.007	Ahmed Alghamdi	0.372	Ahmed Khalil Al-Ani
0.082	Lotfi Raissi	0.007	Ahmed Ressam	0.365	Salem Alhazmi*
0.082	Zakariya Essabar	0.007	Haydar Abu Doha	0.361	Hamza Alghamdi
0.066	Ahmed Al Haznawi	0.006	Kamel Daoudi	0.343	Abu Qatada
0.066	Imad Eddin Barakat Yarkas	0.006	Khalid Al-Mihdhar	0.343	Tarek Maaroufi
0.066	Jerome Courtaillier	0.004	Mohamed Bensakhria	0.339	Ahmed Alghamdi
0.066	Kamel Daoudi	0.003	Nabil al-Marabh	0.335	Waleed Alshehri
0.066	Majed Moqed	0.002	Jerome Courtaillier	0.332	Djamal Beghal
0.066	Mamoun Darkazanli	0.002	Mustafa Ahmed al-Hisawi	0.332	Khalid Al-Mihdhar
0.066	Mohamed Bensakhria	0.002	Said Bahaji	0.332	Saeed Alghamdi*
0.066	Mounir El Motassadeq	0.002	Wail Alshehri	0.328	Majed Moqed
0.066	Mustafa Ahmed al-Hisawi	0.001	Abu Walid	0.324	Ahmed Ressam
0.066	Nabil al-Marabh	0.001	Mehdi Khammoun	0.323	Ahmed Alnami
0.066	Rayed Mohammed Abdullah	0.001	Mohand Alshehri*	0.323	Nabil al-Marabh
0.049	Abdussattar Shaikh	0.001	Raed Hijazi	0.321	Haydar Abu Doha
0.049	Abu Walid	0.001	Rayed Mohammed Abdullah	0.319	Mohamed Bensakhria
0.049	Ahmed Alnami	0.001	Waleed Alshehri	0.316	Essoussi Laaroussi
0.049	Haydar Abu Doha	0.000	Abdelghani Mzoudi	0.316	Jerome Courtaillier
0.049	Mehdi Khammoun	0.000	Abdussattar Shaikh	0.316	Kamel Daoudi
0.049	Osama Awadallah	0.000	Abu Zubeida	0.316	Seifallah ben Hassine
0.049	Raed Hijazi	0.000	Ahmed Alnami	0.314	Rayed Mohammed Abdullah
0.033	Ahmed Ressam	0.000	Ahmed Khalil Al-Ani	0.313	Raed Hijazi
0.033	Bandar Alhazmi	0.000	Bandar Alhazmi	0.311	Abdussattar Shaikh
0.033	David Courtaillier	0.000	David Courtaillier	0.311	Bandar Alhazmi
0.033	Essoussi Laaroussi	0.000	Essoussi Laaroussi	0.311	Faisal Al Salmi
0.033	Faisal Al Salmi	0.000	Faisal Al Salmi	0.311	Mohand Alshehri*
0.033	Lased Ben Heni	0.000	Faisal Al Salmi	0.311	Osama Awadallah
0.033	Mohammed Belfas	0.000	Jean-Marc Grandvisir	0.308	Mehdi Khammoun
0.033	Mohand Alshehri*	0.000	Lased Ben Heni	0.308	Mohamed Abdi
0.033	Seifallah ben Hassine	0.000	Madjid Sahoune	0.307	David Courtaillier
0.016	Abdelghani Mzoudi	0.000	Majed Moqed	0.307	Mohammed Belfas
0.016	Abu Zubeida	0.000	Mamduh Mahmud Salim	0.305	Lased Ben Heni
0.016	Ahmed Khalil Al-Ani	0.000	Mohamed Abdi	0.303	Fahid al Shakri
0.016	Fahid al Shakri	0.000	Mohammed Belfas	0.303	Madjid Sahoune
0.016	Jean-Marc Grandvisir	0.000	Mounir El Motassadeq	0.303	Samir Kishk
0.016	Madjid Sahoune	0.000	Nizar Trabelsi	0.281	Mamduh Mahmud Salim
0.016	Mamduh Mahmud Salim	0.000	Osama Awadallah	0.264	Abu Walid
0.016	Mohamed Abdi	0.000	Samir Kishk	0.250	Abu Zubeida
0.016	Nizar Trabelsi	0.000	Seifallah ben Hassine	0.250	Jean-Marc Grandvisir
0.016	Samir Kishk	0.000	Zakariya Essabar	0.250	Nizar Trabelsi
0.081	Average	0.032	Average	0.052	Average
0.289	Centralization	0.565	Centralization	0.482	Centralization

Yet, we are obviously missing nodes and ties in this network. Centrality measures are very sensitive to minor changes in network connectivity. A discovery of a new conspirator or two, or the uncovering of new ties amongst existing nodes can alter who comes out on top in the centrality measures. We must be wary of incomplete data.

Conclusion

To draw an accurate picture of a covert network, we need to identify task and trust ties between the conspirators. The same four relationships we often map in many business organizations would tell us much about illegal organizations. This data is occasionally difficult to unearth with cooperating clients. With covert criminals, the task is enormous, and may be impossible to complete. Table “3″ below lists multiple project networks and possible data sources about covert collaborators.

Table 3: Networks to Map

Relationship/Network	Data Sources
1. Trust	Prior contacts in family, neighborhood, school, military, club or organization. Public and court records. Data may only be available in suspect’s native country.
2. Task	Logs and records of phone calls, electronic mail, chat rooms, instant messages, Web site visits. Travel records. Human intelligence: observation of meetings and attendance at common events.
3. Money & Resources	Bank account and money transfer records. Pattern and location of credit card use. Prior court records. Human intelligence: observation of visits to alternate banking resources such as Hawala.
4. Strategy & Goals	Web sites. Videos and encrypted disks delivered by courier. Travel records. Human intelligence: observation of meetings and attendance at common events.

Of course, the common network researcher will not have access to many of these sources. The researcher’s best sources may be public court proceedings, which contain much of this data (U.S. Department of Justice, 2001).

The best solution for network disruption may be to discover possible suspects and then, via snowball sampling, map their individual personal networks – see whom else they lead to, and where they overlap. To find these suspects it appears that the best method is for diverse intelligence agencies to aggregate their individual information into a larger emergent map. By sharing information and knowledge, a more complete picture of possible danger can be drawn. In our data search we came across many news accounts where one agency, or country, had data that another would have found very useful.

To win this fight against terrorism it appears that the good guys have to build a better information and knowledge sharing network than the bad guys.